OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
CVE-2026-81871 is fixed in 2 products on 1 platform, first by SUSE-SU-2026:23984-1, released September 30, 2026. It is not reported as exploited. Patch Radar priority: Routine.
This update for helm fixes the following issues: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642). - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285273). - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468). - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.1
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| distribution · opensuse-leap 16.0 | 3.1.1-160000.4.1 | OPENSUSE-SU-2026:22010-1 | Oct 1, 2026 |
| distribution · sles 16.0 | 3.1.1-160000.4.1 | SUSE-SU-2026:23990-1 | Oct 1, 2026 |
| helm · opensuse-leap 16.0 | 4.3.0-160000.1.1 | OPENSUSE-SU-2026:21983-1 | Sep 30, 2026 |
| helm · sles 15.6 | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 | Nov 7, 2026 |
| helm · sles 15.7 | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 | Nov 7, 2026 |
| helm · sles 16.0 | 4.3.0-160000.1.1 | SUSE-SU-2026:23984-1 | Sep 30, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.