https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:50:09.724031+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-05818 bdu:2026-05818 2026-10-02T17:50:10.118605+00:00 bdu:2026-05818 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0466 certfr-2026-avi-0466 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu… 2026-10-02T17:50:10.118674+00:00 certfr-2026-avi-0466 https://cve.radiocsirt.org/vuln/cleanstart-2026-ap95632 Withdrawn: CLEANSTART-2026-AP95632 — Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-… 2026-10-02T17:50:10.118711+00:00

Withdrawn by the publisher.

Affected: CleanStart: keda-fips

Multiple security vulnerabilities affect the keda-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-290317 EUVD-2026-290317 2026-10-02T17:50:10.118774+00:00 EUVD-2026-290317 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39882 fkie_cve-2026-39882 2026-10-02T17:50:10.118799+00:00

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

 https://cve.radiocsirt.org/vuln/ghsa-w8rr-5gcm-pp58 GHSA-w8rr-5gcm-pp58 — opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies 2026-10-02T17:50:10.118842+00:00

Affected: Go: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, Go: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, Go: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp

overview: this report shows that the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory `bytes.Buffer` without a size cap.

this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection).

severity

HIGH

not claiming: this is a remote dos against every default deployment. claiming: if the exporter sends traces to an untrusted collector endpoint (or over a network segment where mitm is realistic), that endpoint can crash the process via a large response body.

callsite (pinned): - exporters/otlp/otlptrace/otlptracehttp/client.go:199 - exporters/otlp/otlptrace/otlptracehttp/client.go:230 - exporters/otlp/otlpmetric/otlpmetrichttp/client.go:170 - exporters/otlp/otlpmetric/otlpmetrichttp/client.go:201 - exporters/otlp/otlplog/otlploghttp/client.go:190 - exporters/otlp/otlplog/otlploghttp/client.go:221

permalinks (pinned): - https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L199 - https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L230 - https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L170 - https://github.com/open-telemetry/opentelemetry-go/blob/248da958…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-39882 msrc_CVE-2026-39882 — OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies 2026-10-02T17:50:10.118936+00:00 msrc_CVE-2026-39882 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11619-1 openSUSE-SU-2026:11619-1 — grafana-12.4.5-4.1 on GA media 2026-10-02T17:50:10.118973+00:00

grafana-12.4.5-4.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:37585 RHSA-2026:37585 — Red Hat Security Advisory: OpenShift Container Platform 4.22.5 bug fix and security update 2026-10-02T17:50:10.119012+00:00

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading

 https://cve.radiocsirt.org/vuln/suse-su-2026:3713-1 SUSE-SU-2026:3713-1 — Security update for Multi-Linux Manager Client Tools - Monitoring stack 2026-10-02T17:50:10.119060+00:00

Security update for Multi-Linux Manager Client Tools - Monitoring stack

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39882 UBUNTU-CVE-2026-39882 2026-10-02T17:50:10.119101+00:00

Affected: Ubuntu:22.04:LTS: golang-opentelemetry-otel, Ubuntu:24.04:LTS: golang-opentelemetry-otel, Ubuntu:25.10: golang-opentelemetry-otel, Ubuntu:26.04:LTS: golang-opentelemetry-otel

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2334 WID-SEC-W-2026-2334 — Red Hat OpenShift Container Platform (fast-uri,OpenTelemetry-Go) : Mehrere Schwachstellen 2026-10-02T17:50:10.119162+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial-of-Service-Zustand auszulösen.