[ALSA-2026:93617] Important: opentelemetry-collector security update
Type:
security
Severity:
important
Release date:
2026-11-04
Description:
Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 opentelemetry-collector-0.158.0-2.el9_8.aarch64.rpm bb4a2b89f9fd5a78a9b5006af8de0e93960ef09296ec4ea75b6ef0d1d8452147
ppc64le opentelemetry-collector-0.158.0-2.el9_8.ppc64le.rpm d1f37c26d7226c6d02b60dc9093b7ab74562cad27e8921411e24362889b47f66
s390x opentelemetry-collector-0.158.0-2.el9_8.s390x.rpm 3820d9fd0682a562f08e377001af84222d20feb8065516a0a241f9b9826ca6fe
x86_64 opentelemetry-collector-0.158.0-2.el9_8.x86_64.rpm babd5d6a71ccdb6b9f34e8544f445e6b24bfa0a15980f68b545e469ab945cb14
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.