OpenTelemetry Collector: Unsafe decompression

Impact

Unsafe decompression -> unauthenticated attacker crashes the collector via excessive memory consumption

Who can reach it

Network (remote)

What to do

Data-plane: upgrade both node agents and the gateway to 0.102.1+

References

Related entries

• VMware Aria Automation (DOM-based XSS, token theft): A crafted URL steals the access token of a logged-in AriaCVE-2025-22249 · VMware Aria Automation (DOM-based XSS, token theft)High
• OpenShift Hive / MCE / ACM (vCenter credential exposure): vCenter credentials are written into the ClusterProvisionCVE-2025-2241 · OpenShift Hive / MCE / ACM (vCenter credential exposure)High
• Jenkins (Git Parameter plugin): Git parameter value is not validated against the offered choicesCVE-2025-53652 · Jenkins (Git Parameter plugin)High
• Foreman: command injection in the errors:fetch_log rake task escalates a scoped sudo grant to full code executionCVE-2026-12540 · Foreman / Red Hat Satellite (foreman-rake errors:fetch_log task)High
• Foreman / Red Hat Satellite: shell injection via foreman-rake db:dump and db:import_dump pathsCVE-2026-12541 · Foreman / Red Hat Satellite (foreman-rake db:dump and db:import_dump tasks)High
• IBM AIX and PowerVM VIOS: improper authentication allows remote access to NFS exportsCVE-2026-16686 · IBM AIX / PowerVM VIOS NFS server (export authentication)High