Critical Security Update for opentelemetry-collector: Denial of Service Vulnerabilities
Summary
ALSA-2026:65116: Important: opentelemetry-collector security update. Affects opentelemetry-collector versions < 0.152.1-2.el10_2. Fixed in 0.152.1-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The opentelemetry-collector is a key component in the OpenTelemetry framework, designed to collect and export telemetry data from various sources. It plays a crucial role in observability by enabling developers to monitor application performance and troubleshoot issues. However, recent vulnerabilities have been identified that could lead to Denial of Service (DoS) attacks, affecting the reliability and availability of applications using this package.
Vulnerability Detail
The vulnerabilities stem from various components within the opentelemetry-collector and its dependencies, including the Go programming language libraries. Specific issues include Denial of Service via pathological email address parsing, crafted email inputs, maliciously-crafted MIME headers, oversized baggage headers, excessive recursion in ASN.1 unmarshalling, and quadratic complexity in path resolution. These vulnerabilities can be exploited by attackers to cause service disruptions, leading to potential downtime and loss of service for users.
How To Fix
Minimum fixed version
0.152.1-2.el10_2
This is the first release that contains the fix.
sudo dnf update opentelemetry-collectorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation and sanitization measures to mitigate the risk of exploitation. For example, ensure that email addresses and MIME headers are properly formatted and do not contain unexpected characters. Additionally, monitor your application for unusual traffic patterns that may indicate an attempted attack.
Conclusion
The opentelemetry-collector has critical vulnerabilities that can lead to Denial of Service attacks. It is crucial to update to the latest patched version to ensure the security and reliability of your applications. Implementing workarounds can provide temporary relief, but updating should be prioritized.
See every vulnerability recorded for opentelemetry-collector →
FAQ
The vulnerabilities can lead to Denial of Service attacks, causing applications to become unresponsive or crash, which can significantly affect user experience and service availability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, implementing input validation and monitoring for unusual traffic can help mitigate risks until you can apply the update.
The vulnerabilities are associated with multiple CVEs, including CVE-2026-33818, CVE-2026-39820, CVE-2026-41178, CVE-2026-42499, CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, and CVE-2026-56862.
For more details, refer to the CVE pages listed in the references section of the vulnerability advisory.
Related vulnerabilities
Recent vulnerabilities recorded for opentelemetry-collector.
