https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 08:14:09 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-05818 bdu:2026-05818 https://cve.radiocsirt.org/vuln/bdu:2026-05818 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0466 certfr-2026-avi-0466 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0466 https://cve.radiocsirt.org/vuln/cleanstart-2026-ap95632 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: keda-fips</p> <p>Multiple security vulnerabilities affect the keda-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: keda-fips</p> <p>Multiple security vulnerabilities affect the keda-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ap95632 https://cve.radiocsirt.org/vuln/euvd-2026-290317 EUVD-2026-290317 https://cve.radiocsirt.org/vuln/euvd-2026-290317 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39882 <p>OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.</p> <p>OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39882 https://cve.radiocsirt.org/vuln/ghsa-w8rr-5gcm-pp58 <p><strong>Affected:</strong> Go: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, Go: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, Go: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</p> <p>overview: this report shows that the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory `bytes.Buffer` without a size cap.</p> <p>this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection).</p> <p>severity</p> <p>HIGH</p> <p>not claiming: this is a remote dos against every default deployment. claiming: if the exporter sends traces to an untrusted collector endpoint (or over a network segment where mitm is realistic), that endpoint can crash the process via a large response body.</p> <p>callsite (pinned): - exporters/otlp/otlptrace/otlptracehttp/client.go:199 - exporters/otlp/otlptrace/otlptracehttp/client.go:230 - exporters/otlp/otlpmetric/otlpmetrichttp/client.go:170 - exporters/otlp/otlpmetric/otlpmetrichttp/client.go:201 - exporters/otlp/otlplog/otlploghttp/client.go:190 - exporters/otlp/otlplog/otlploghttp/client.go:221</p> <p>permalinks (pinned): - https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L199 - https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L230 - https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L170 - https://github.com/open-telemetry/opentelemetry-go/blob/248da958…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, Go: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, Go: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</p> <p>overview: this report shows that the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory `bytes.Buffer` without a size cap.</p> <p>this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection).</p> <p>severity</p> <p>HIGH</p> <p>not claiming: this is a remote dos against every default deployment. claiming: if the exporter sends traces to an untrusted collector endpoint (or over a network segment where mitm is realistic), that endpoint can crash the process via a large response body.</p> <p>callsite (pinned): - exporters/otlp/otlptrace/otlptracehttp/client.go:199 - exporters/otlp/otlptrace/otlptracehttp/client.go:230 - exporters/otlp/otlpmetric/otlpmetrichttp/client.go:170 - exporters/otlp/otlpmetric/otlpmetrichttp/client.go:201 - exporters/otlp/otlplog/otlploghttp/client.go:190 - exporters/otlp/otlplog/otlploghttp/client.go:221</p> <p>permalinks (pinned): - https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L199 - https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L230 - https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L170 - https://github.com/open-telemetry/opentelemetry-go/blob/248da958…</p> https://cve.radiocsirt.org/vuln/ghsa-w8rr-5gcm-pp58 https://cve.radiocsirt.org/vuln/msrc_cve-2026-39882 msrc_CVE-2026-39882 https://cve.radiocsirt.org/vuln/msrc_cve-2026-39882 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11619-1 <p>grafana-12.4.5-4.1 on GA media</p> <p>grafana-12.4.5-4.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11619-1 https://cve.radiocsirt.org/vuln/rhsa-2026:37585 <p>fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading</p> <p>fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading</p> https://cve.radiocsirt.org/vuln/rhsa-2026:37585 https://cve.radiocsirt.org/vuln/suse-su-2026:3713-1 <p>Security update for Multi-Linux Manager Client Tools - Monitoring stack</p> <p>Security update for Multi-Linux Manager Client Tools - Monitoring stack</p> https://cve.radiocsirt.org/vuln/suse-su-2026:3713-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39882 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-opentelemetry-otel, Ubuntu:24.04:LTS: golang-opentelemetry-otel, Ubuntu:25.10: golang-opentelemetry-otel, Ubuntu:26.04:LTS: golang-opentelemetry-otel</p> <p>OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-opentelemetry-otel, Ubuntu:24.04:LTS: golang-opentelemetry-otel, Ubuntu:25.10: golang-opentelemetry-otel, Ubuntu:26.04:LTS: golang-opentelemetry-otel</p> <p>OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39882 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2334 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2334