https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:15:03 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-324040 EUVD-2026-324040 https://cve.radiocsirt.org/vuln/euvd-2026-324040 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45685 <p>OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads before the input is fully validated, so a single crafted message can terminate telemetry collection for the affected process or node. This issue has been patched in version 0.9.0.</p> <p>OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads before the input is fully validated, so a single crafted message can terminate telemetry collection for the affected process or node. This issue has been patched in version 0.9.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45685 https://cve.radiocsirt.org/vuln/ghsa-j8p6-96vp-f3r9 <p><strong>Affected:</strong> Go: go.opentelemetry.io/obi</p> <p>### Summary</p> <p>Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads before the input is fully validated, so a single crafted message can terminate telemetry collection for the affected process or node.</p> <p>### Details</p> <p>MongoDB parsing support was introduced by commit `2070f568a` (`Add Initial support for mongodb`), so the explicit released version minimum affected is `v0.1.0`.</p> <p>There are two related panic conditions in released `go.opentelemetry.io/obi` versions:</p> <p>- In `v0.1.0` through `v0.3.0`, `parseOpMessage` reads OP_MSG flag bits from `buf[msgHeaderSize:msgHeaderSize+int32Size]` without first ensuring the buffer is at least `msgHeaderSize + int32Size` bytes long. A truncated OP_MSG packet can therefore trigger a slice-bounds panic before the parser returns an error. - In `v0.1.0` through `v0.3.0`, `parseSections` consumes the section type byte and then reads the document-sequence length from `buf[offSet:offSet+int32Size]` without re-validating that enough bytes remain after the type byte. A malformed document-sequence section can therefore trigger another slice-bounds panic. - In `v0.1.0` through `v0.8.0`, `parseFirstField` assumes the collection name for collection-scoped commands is always a string and performs an unchecked type assertion on `field.Value`. A malformed BSON do…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/obi</p> <p>### Summary</p> <p>Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads before the input is fully validated, so a single crafted message can terminate telemetry collection for the affected process or node.</p> <p>### Details</p> <p>MongoDB parsing support was introduced by commit `2070f568a` (`Add Initial support for mongodb`), so the explicit released version minimum affected is `v0.1.0`.</p> <p>There are two related panic conditions in released `go.opentelemetry.io/obi` versions:</p> <p>- In `v0.1.0` through `v0.3.0`, `parseOpMessage` reads OP_MSG flag bits from `buf[msgHeaderSize:msgHeaderSize+int32Size]` without first ensuring the buffer is at least `msgHeaderSize + int32Size` bytes long. A truncated OP_MSG packet can therefore trigger a slice-bounds panic before the parser returns an error. - In `v0.1.0` through `v0.3.0`, `parseSections` consumes the section type byte and then reads the document-sequence length from `buf[offSet:offSet+int32Size]` without re-validating that enough bytes remain after the type byte. A malformed document-sequence section can therefore trigger another slice-bounds panic. - In `v0.1.0` through `v0.8.0`, `parseFirstField` assumes the collection name for collection-scoped commands is always a string and performs an unchecked type assertion on `field.Value`. A malformed BSON do…</p> https://cve.radiocsirt.org/vuln/ghsa-j8p6-96vp-f3r9 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11053-1 <p>alloy-1.17.0-1.1 on GA media</p> <p>alloy-1.17.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11053-1 https://cve.radiocsirt.org/vuln/suse-su-2026:22575-1 <p>Security update for alloy</p> <p>Security update for alloy</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22575-1