https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:54:17 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-ep15881 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cert-manager-webhook-pdns-fips</p> <p>Package cert-manager-webhook-pdns-fips version 2.3.0-r0 fixes 17 vulnerabilities: CVE-2022-1996, CVE-2023-45142, CVE-2023-25151, CVE-2022-21698, CVE-2022-30636...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cert-manager-webhook-pdns-fips</p> <p>Package cert-manager-webhook-pdns-fips version 2.3.0-r0 fixes 17 vulnerabilities: CVE-2022-1996, CVE-2023-45142, CVE-2023-25151, CVE-2022-21698, CVE-2022-30636...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ep15881 https://cve.radiocsirt.org/vuln/euvd-2026-221599 EUVD-2026-221599 https://cve.radiocsirt.org/vuln/euvd-2026-221599 https://cve.radiocsirt.org/vuln/fkie_cve-2023-25151 <p>opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments. The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not &#34;forget&#34; previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack. This issue has been addressed in version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue.</p> <p>opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments. The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not &#34;forget&#34; previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack. This issue has been addressed in version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-25151 https://cve.radiocsirt.org/vuln/ghsa-5r5m-65gx-7vrh <p><strong>Affected:</strong> Go: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp, Go: go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego</p> <p>### Impact</p> <p>The [v0.38.0](https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.13.0) release of [`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/463c2e7cd69d25f40b0a595b05394eeb26c68ae2/instrumentation/net/http/otelhttp/handler.go#L218) uses the [`httpconv.ServerRequest`](https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159) function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments.</p> <p>The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not &#34;forget&#34; previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack.</p> <p>Pseudo-attack: ``` for infinite loop { r := generate_random_string() do_http_request(&#34;/some/path?random=&#34;+r) } ```</p> <p>### Patches - `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` - v0.39.0 - `go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego` - v0.39.0</p> <p>[^1]: https://github.com/open-telemetry/opentelemetry-…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp, Go: go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego</p> <p>### Impact</p> <p>The [v0.38.0](https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.13.0) release of [`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/463c2e7cd69d25f40b0a595b05394eeb26c68ae2/instrumentation/net/http/otelhttp/handler.go#L218) uses the [`httpconv.ServerRequest`](https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159) function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments.</p> <p>The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not &#34;forget&#34; previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack.</p> <p>Pseudo-attack: ``` for infinite loop { r := generate_random_string() do_http_request(&#34;/some/path?random=&#34;+r) } ```</p> <p>### Patches - `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` - v0.39.0 - `go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego` - v0.39.0</p> <p>[^1]: https://github.com/open-telemetry/opentelemetry-…</p> https://cve.radiocsirt.org/vuln/ghsa-5r5m-65gx-7vrh https://cve.radiocsirt.org/vuln/gsd-2023-25151 gsd-2023-25151 https://cve.radiocsirt.org/vuln/gsd-2023-25151 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-25151 <p><strong>Affected:</strong> Ubuntu:25.10: golang-opentelemetry-contrib, Ubuntu:26.04:LTS: golang-opentelemetry-contrib</p> <p>opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments. The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not &#34;forget&#34; previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack. This issue has been addressed in version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue.</p> <p><strong>Affected:</strong> Ubuntu:25.10: golang-opentelemetry-contrib, Ubuntu:26.04:LTS: golang-opentelemetry-contrib</p> <p>opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments. The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not &#34;forget&#34; previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack. This issue has been addressed in version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-25151