Red Hat Hardened Images Update OpenTelemetry Collector for AMQP Denial of Service
Tech GuruQuick Answer
The authority published RHSA-2026:80217 for Red Hat Hardened Images opentelemetry-collector-contrib RPM on aarch64 and x86_64. Red Hat fixed two amqp091-go memory-exhaustion paths: oversized AMQP payloads from a malicious broker and a crafted frame header during connection setup before authentication completes. Either can terminate an affected collector process and disrupt telemetry processing. Affected deployments should be matched to the authority's exact scope and moved to the supported fixed release.
Rebuild And Redeploy The Supported Hardened Image
What to do now: Inventory images and workloads containing the affected RPM family, replace them with content carrying opentelemetry-collector-contrib-0.162.0-0.2.hum1, redeploy through the supported image pipeline, validate service behavior, and retain package and image-digest evidence.
Last verified: 2026-10-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat Hardened Images opentelemetry-collector-contrib RPM on aarch64 and x86_64 |
|---|---|
| Advisory | RHSA-2026:80217 |
| CVEs | CVE-2026-107386, CVE-2026-79921 |
| Authoritative release date | 2026-10-09 21:24:05 UTC |
| Authority revision date | 2026-10-09 23:27:19 UTC |
| Affected versions | Red Hat Hardened Images containing opentelemetry-collector-contrib builds before 0.162.0-0.2.hum1 on the advisory-listed architectures. |
| Fixed version | opentelemetry-collector-contrib 0.162.0-0.2.hum1 for aarch64 or x86_64, using supported Red Hat Hardened Images content |
| CVSS base score | 5.9 / 7.5 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Red Hat fixed two amqp091-go memory-exhaustion paths: oversized AMQP payloads from a malicious broker and a crafted frame header during connection setup before authentication completes. Either can terminate an affected collector process and disrupt telemetry processing.
What To Validate Now
- Inventory. Locate Red Hat Hardened Images opentelemetry-collector-contrib RPM on aarch64 and x86_64, including registries, build pipelines, derived images, clusters, workload owners, and the RPM NEVRA and image digest actually deployed.
- Establish applicability. Match the exact Red Hat Hardened Images RPM and architecture statement: Red Hat Hardened Images containing opentelemetry-collector-contrib builds before 0.162.0-0.2.hum1 on the advisory-listed architectures. Do not apply this advisory to upstream packages or unrelated Red Hat products without authority evidence.
- Remediate. Use opentelemetry-collector-contrib 0.162.0-0.2.hum1 for aarch64 or x86_64, using supported Red Hat Hardened Images content or supported superseding content, rebuild derived images, and redeploy every affected workload. Red Hat states that no acceptable workaround is available.
- Validate. Confirm package NEVRAs and immutable image digests in the registry and running workloads, exercise representative application behavior, monitor resource use and restarts, and verify rollback readiness.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use supported Red Hat Hardened Images content, confirm every rebuilt image digest and deployed workload, and monitor collector memory, restarts, and telemetry gaps. No acceptable workaround is available; preserve image, package, rollout, broker, and validation evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
