# CVE-2026-41178: opentelemetry-collector: OpenTelemetry-Go is the Go implementation of OpenTelemetry CVE-2026-41178 is fixed in 35 products on 1 platform, first by RHSA-2026:67139, released June 4, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-41178 - Priority: High - CVSS: 8.2 (important) - EPSS: 0.0034 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 4, 2026 ## Description OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | alloy opensuse-leap 16.0 | 1.19.2-160000.1.1 | [OPENSUSE-SU-2026:22032-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22032-1.md) | Oct 6, 2026 | | Linux | alloy sles 15.7 | 1.19.2-150700.15.29.1 | [SUSE-SU-2026:4408-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4408-1.md) | Oct 1, 2026 | | Linux | alloy sles 16.0 | 1.19.2-160000.1.1 | [SUSE-SU-2026:24148-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24148-1.md) | Oct 6, 2026 | | Linux | amazon-cloudwatch-agent sles 15.6 | 1.300069.0-150400.9.10.1 | [SUSE-SU-2026:4045-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4045-1.md) | Sep 7, 2026 | | Linux | amazon-cloudwatch-agent sles 15.7 | 1.300069.0-150400.9.10.1 | [SUSE-SU-2026:4045-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4045-1.md) | Sep 7, 2026 | | Linux | amazon-ecs-init opensuse-leap 16.0 | 1.107.0-160000.1.1 | [OPENSUSE-SU-2026:22035-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22035-1.md) | Oct 6, 2026 | | Linux | amazon-ecs-init sles 16.0 | 1.107.0-160000.1.1 | [SUSE-SU-2026:24150-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24150-1.md) | Oct 6, 2026 | | Linux | apptainer opensuse-leap 16.0 | 1.5.3-bp160.3.1 | [OPENSUSE-SU-2026:21787-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21787-1.md) | Sep 2, 2026 | | Linux | apptainer sles 15.7 | 1.5.3-150600.4.40.1 | [SUSE-SU-2026:3928-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3928-1.md) | Sep 3, 2026 | | Linux | azure-storage-azcopy sles 15.6 | 10.32.8-150400.9.21.1 | [SUSE-SU-2026:4125-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4125-1.md) | Sep 11, 2026 | | Linux | azure-storage-azcopy sles 15.7 | 10.32.8-150400.9.21.1 | [SUSE-SU-2026:4125-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4125-1.md) | Sep 11, 2026 | | Linux | cadvisor opensuse-leap 16.0 | 0.60.5-bp160.1.1 | [OPENSUSE-SU-2026:21786-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21786-1.md) | Sep 2, 2026 | | Linux | cloudflared opensuse-leap 16.0 | 2026.9.1-bp160.1.1 | [OPENSUSE-SU-2026:21924-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21924-1.md) | Sep 21, 2026 | | Linux | containerized-data-importer sles 15.7 | 1.64.0-150700.9.14.1 | [SUSE-SU-2026:4209-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4209-1.md) | Sep 16, 2026 | | Linux | containerized-data-importer1.65 opensuse-leap 16.0 | 1.65.0-160000.3.1 | [OPENSUSE-SU-2026:21824-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21824-1.md) | Sep 9, 2026 | | Linux | coredns opensuse-leap 16.0 | 1.14.7-bp160.1.1 | [OPENSUSE-SU-2026:21674-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21674-1.md) | Aug 28, 2026 | | Linux | distribution opensuse-leap 16.0 | 3.1.1-160000.3.1 | [OPENSUSE-SU-2026:21898-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21898-1.md) | Sep 21, 2026 | | Linux | distribution sles 16.0 | 3.1.1-160000.3.1 | [SUSE-SU-2026:23864-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23864-1.md) | Sep 21, 2026 | | Linux | docker-distribution Fedora 43 | 3.1.2-1.fc43 | [FEDORA-2026-E60AC68542](https://patchblox.com/security/data/fix/linux/fedora-2026-e60ac68542.md) | Sep 24, 2026 | | Linux | docker-distribution-debuginfo Fedora 43 | 3.1.2-1.fc43 | [FEDORA-2026-E60AC68542](https://patchblox.com/security/data/fix/linux/fedora-2026-e60ac68542.md) | Sep 24, 2026 | | Linux | docker-distribution-debugsource Fedora 43 | 3.1.2-1.fc43 | [FEDORA-2026-E60AC68542](https://patchblox.com/security/data/fix/linux/fedora-2026-e60ac68542.md) | Sep 24, 2026 | | Linux | flightctl RHEL 10 | 1.2.1-1.el10 | [RHSA-2026:68335](https://patchblox.com/security/data/fix/linux/rhsa-2026-68335.md) | Aug 13, 2026 | | Linux | gh opensuse-leap 16.0 | 2.102.0-bp160.1.1 | [OPENSUSE-SU-2026:22134-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22134-1.md) | Nov 7, 2026 | | Linux | golang-opentelemetry-otel Debian 14 | 1.46.0-2 | [DEBIAN-CVE-2026-41178](https://patchblox.com/security/data/fix/linux/debian-cve-2026-41178.md) | Jun 4, 2026 | | Linux | google-cloud-sap-agent opensuse-leap 16.0 | 3.15-160000.3.1 | [OPENSUSE-SU-2026:21755-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21755-1.md) | Sep 3, 2026 | | Linux | google-cloud-sap-agent sles 16.0 | 3.15-160000.3.1 | [SUSE-SU-2026:23619-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23619-1.md) | Sep 3, 2026 | | Linux | google-osconfig-agent opensuse-leap 16.0 | 20260911.00-160000.1.1 | [OPENSUSE-SU-2026:21882-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21882-1.md) | Sep 19, 2026 | | Linux | google-osconfig-agent sles 15.6 | 20260911.00-150000.1.67.1 | [SUSE-SU-2026:4293-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4293-1.md) | Sep 23, 2026 | | Linux | google-osconfig-agent sles 15.7 | 20260911.00-150000.1.67.1 | [SUSE-SU-2026:4293-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4293-1.md) | Sep 23, 2026 | | Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260727T201416-160000.1.1 | [OPENSUSE-SU-2026:21551-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21551-1.md) | Aug 10, 2026 | | Linux | govulncheck-vulndb sles 16.0 | 0.0.20260727T201416-160000.1.1 | [SUSE-SU-2026:23227-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23227-1.md) | Aug 10, 2026 | | Linux | grafana opensuse-leap 16.0 | 12.4.10-bp160.1.1 | [OPENSUSE-SU-2026:22125-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22125-1.md) | Nov 7, 2026 | | Linux | grafana sles 15.7 | 12.4.10-150200.3.94.3 | [SUSE-SU-2026:4600-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4600-1.md) | Nov 7, 2026 | | Linux | hauler opensuse-leap 16.0 | 2.1.0-bp160.1.1 | [OPENSUSE-SU-2026:21793-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21793-1.md) | Sep 3, 2026 | | Linux | helm opensuse-leap 16.0 | 4.3.0-160000.1.1 | [OPENSUSE-SU-2026:21983-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21983-1.md) | Sep 30, 2026 | | Linux | helm sles 15.6 | 3.21.3-150000.1.96.1 | [SUSE-SU-2026:4175-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4175-1.md) | Sep 14, 2026 | | Linux | helm sles 15.7 | 3.21.3-150000.1.96.1 | [SUSE-SU-2026:4175-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4175-1.md) | Sep 14, 2026 | | Linux | helm sles 16.0 | 4.3.0-160000.1.1 | [SUSE-SU-2026:23984-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23984-1.md) | Sep 30, 2026 | | Linux | image-builder RHEL 10 | 52.1-2.el10_2 | [RHSA-2026:67139](https://patchblox.com/security/data/fix/linux/rhsa-2026-67139.md) | Jun 4, 2026 | | Linux | image-builder RHEL 9 | 0:52.1-2.el9_8 | [RHSA-2026:67138](https://patchblox.com/security/data/fix/linux/rhsa-2026-67138.md) | Sep 19, 2026 | | Linux | image-builder ol 10 | 0:72.0.0-1.0.3.el10 | [ELSA-2026-67139-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67139-0.md) | Sep 17, 2026 | | Linux | image-builder ol 9 | 0:72.0.0-1.0.3.el9 | [ELSA-2026-67138-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67138-0.md) | Sep 17, 2026 | | Linux | image-builder rocky 10 | 0:52.1-2.el10_2.rocky.0.1 | [RLSA-2026:67139](https://patchblox.com/security/data/fix/linux/rlsa-2026-67139.md) | Sep 15, 2026 | | Linux | image-builder rocky 9 | 0:52.1-2.el9_8 | [RLSA-2026:67138](https://patchblox.com/security/data/fix/linux/rlsa-2026-67138.md) | Sep 15, 2026 | | Linux | lego Fedora 43 | 5.4.0-1.fc43 | [FEDORA-2026-3DEA695305](https://patchblox.com/security/data/fix/linux/fedora-2026-3dea695305.md) | Aug 21, 2026 | | Linux | lego-debuginfo Fedora 43 | 5.4.0-1.fc43 | [FEDORA-2026-3DEA695305](https://patchblox.com/security/data/fix/linux/fedora-2026-3dea695305.md) | Aug 21, 2026 | | Linux | lego-debugsource Fedora 43 | 5.4.0-1.fc43 | [FEDORA-2026-3DEA695305](https://patchblox.com/security/data/fix/linux/fedora-2026-3dea695305.md) | Aug 21, 2026 | | Linux | mcphost opensuse-leap 16.0 | 0.34.0-160000.4.1 | [OPENSUSE-SU-2026:21771-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21771-1.md) | Sep 6, 2026 | | Linux | mcphost sles 16.0 | 0.34.0-160000.4.1 | [SUSE-SU-2026:23636-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23636-1.md) | Sep 6, 2026 | | Linux | opentelemetry-collector RHEL 10 | 0.152.1-2.el10_0 | [RHSA-2026:67974](https://patchblox.com/security/data/fix/linux/rhsa-2026-67974.md) | Sep 10, 2026 | | Linux | opentelemetry-collector RHEL 9 | 0:0.152.1-2.el9_8 | [RHSA-2026:65117](https://patchblox.com/security/data/fix/linux/rhsa-2026-65117.md) | Sep 13, 2026 | | Linux | opentelemetry-collector almalinux 10 | 0.152.1-2.el10_2 | [ALSA-2026:65116](https://patchblox.com/security/data/fix/linux/alsa-2026-65116.md) | Sep 8, 2026 | | Linux | opentelemetry-collector almalinux 9 | 0.152.1-2.el9_8 | [ALSA-2026:65117](https://patchblox.com/security/data/fix/linux/alsa-2026-65117.md) | Sep 8, 2026 | | Linux | opentelemetry-collector rocky 10 | 0:0.152.1-2.el10_2 | [RLSA-2026:65116](https://patchblox.com/security/data/fix/linux/rlsa-2026-65116.md) | Sep 9, 2026 | | Linux | opentelemetry-collector rocky 9 | 0:0.152.1-2.el9_8 | [RLSA-2026:65117](https://patchblox.com/security/data/fix/linux/rlsa-2026-65117.md) | Sep 9, 2026 | | Linux | osbuild-composer RHEL 10 | 134.1-12.el10_0 | [RHSA-2026:66327](https://patchblox.com/security/data/fix/linux/rhsa-2026-66327.md) | Sep 10, 2026 | | Linux | osbuild-composer RHEL 8 | 0:101.5-3.el8_10 | [RHSA-2026:67148](https://patchblox.com/security/data/fix/linux/rhsa-2026-67148.md) | Sep 19, 2026 | | Linux | osbuild-composer RHEL 9 | 0:165.1-5.el9_8 | [RHSA-2026:69293](https://patchblox.com/security/data/fix/linux/rhsa-2026-69293.md) | Sep 22, 2026 | | Linux | osbuild-composer almalinux 10 | 165.1-5.el10_2.alma.1 | [ALSA-2026:66432](https://patchblox.com/security/data/fix/linux/alsa-2026-66432.md) | Sep 10, 2026 | | Linux | osbuild-composer almalinux 8 | 101.5-3.el8_10.alma.1 | [ALSA-2026:67148](https://patchblox.com/security/data/fix/linux/alsa-2026-67148.md) | Sep 14, 2026 | | Linux | osbuild-composer almalinux 9 | 165.1-5.el9_8.alma.1 | [ALSA-2026:69293](https://patchblox.com/security/data/fix/linux/alsa-2026-69293.md) | Sep 21, 2026 | | Linux | osbuild-composer ol 10 | 0:176-1.0.3.el10_2 | [ELSA-2026-66432-0](https://patchblox.com/security/data/fix/linux/elsa-2026-66432-0.md) | Sep 14, 2026 | | Linux | osbuild-composer ol 8 | 0:101.5-3.0.1.el8_10 | [ELSA-2026-67148-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67148-0.md) | Sep 28, 2026 | | Linux | osbuild-composer ol 9 | 0:175-1.0.2.el9_8 | [ELSA-2026-69293](https://patchblox.com/security/data/fix/linux/elsa-2026-69293.md) | Nov 7, 2026 | | Linux | osbuild-composer rocky 10 | 0:165.1-5.el10_2.rocky.0.1 | [RLSA-2026:66432](https://patchblox.com/security/data/fix/linux/rlsa-2026-66432.md) | Sep 11, 2026 | | Linux | osbuild-composer rocky 8 | 0:101.5-3.el8_10.rocky.0.6 | [RLSA-2026:67148](https://patchblox.com/security/data/fix/linux/rlsa-2026-67148.md) | Sep 15, 2026 | | Linux | osbuild-composer rocky 9 | 0:165.1-5.el9_8.rocky.0.1 | [RLSA-2026:69293](https://patchblox.com/security/data/fix/linux/rlsa-2026-69293.md) | Sep 22, 2026 | | Linux | osbuild-composer-core RHEL 8 | 0:101.5-3.el8_10 | [RHSA-2026:67148](https://patchblox.com/security/data/fix/linux/rhsa-2026-67148.md) | Sep 19, 2026 | | Linux | osbuild-composer-core RHEL 9 | 0:165.1-5.el9_8 | [RHSA-2026:69293](https://patchblox.com/security/data/fix/linux/rhsa-2026-69293.md) | Sep 22, 2026 | | Linux | osbuild-composer-core almalinux 10 | 165.1-5.el10_2.alma.1 | [ALSA-2026:66432](https://patchblox.com/security/data/fix/linux/alsa-2026-66432.md) | Sep 10, 2026 | | Linux | osbuild-composer-core almalinux 8 | 101.5-3.el8_10.alma.1 | [ALSA-2026:67148](https://patchblox.com/security/data/fix/linux/alsa-2026-67148.md) | Sep 14, 2026 | | Linux | osbuild-composer-core almalinux 9 | 165.1-5.el9_8.alma.1 | [ALSA-2026:69293](https://patchblox.com/security/data/fix/linux/alsa-2026-69293.md) | Sep 21, 2026 | | Linux | osbuild-composer-core ol 10 | 0:176-1.0.3.el10_2 | [ELSA-2026-66432-0](https://patchblox.com/security/data/fix/linux/elsa-2026-66432-0.md) | Sep 14, 2026 | | Linux | osbuild-composer-core ol 8 | 0:101.5-3.0.1.el8_10 | [ELSA-2026-67148-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67148-0.md) | Sep 28, 2026 | | Linux | osbuild-composer-core ol 9 | 0:175-1.0.2.el9_8 | [ELSA-2026-69293](https://patchblox.com/security/data/fix/linux/elsa-2026-69293.md) | Nov 7, 2026 | | Linux | osbuild-composer-worker RHEL 8 | 0:101.5-3.el8_10 | [RHSA-2026:67148](https://patchblox.com/security/data/fix/linux/rhsa-2026-67148.md) | Sep 19, 2026 | | Linux | osbuild-composer-worker RHEL 9 | 0:165.1-5.el9_8 | [RHSA-2026:69293](https://patchblox.com/security/data/fix/linux/rhsa-2026-69293.md) | Sep 22, 2026 | | Linux | osbuild-composer-worker almalinux 10 | 165.1-5.el10_2.alma.1 | [ALSA-2026:66432](https://patchblox.com/security/data/fix/linux/alsa-2026-66432.md) | Sep 10, 2026 | | Linux | osbuild-composer-worker almalinux 8 | 101.5-3.el8_10.alma.1 | [ALSA-2026:67148](https://patchblox.com/security/data/fix/linux/alsa-2026-67148.md) | Sep 14, 2026 | | Linux | osbuild-composer-worker almalinux 9 | 165.1-5.el9_8.alma.1 | [ALSA-2026:69293](https://patchblox.com/security/data/fix/linux/alsa-2026-69293.md) | Sep 21, 2026 | | Linux | osbuild-composer-worker ol 10 | 0:176-1.0.3.el10_2 | [ELSA-2026-66432-0](https://patchblox.com/security/data/fix/linux/elsa-2026-66432-0.md) | Sep 14, 2026 | | Linux | osbuild-composer-worker ol 8 | 0:101.5-3.0.1.el8_10 | [ELSA-2026-67148-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67148-0.md) | Sep 28, 2026 | | Linux | osbuild-composer-worker ol 9 | 0:175-1.0.2.el9_8 | [ELSA-2026-69293](https://patchblox.com/security/data/fix/linux/elsa-2026-69293.md) | Nov 7, 2026 | | Linux | pack Fedora 43 | 0.40.9-1.fc43 | [FEDORA-2026-70DD9B4FC0](https://patchblox.com/security/data/fix/linux/fedora-2026-70dd9b4fc0.md) | Aug 13, 2026 | | Linux | system-user-grafana sles 15.7 | 1.0.0-150200.5.8.1 | [SUSE-SU-2026:4600-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4600-1.md) | Nov 7, 2026 | | Linux | trivy opensuse-leap 16.0 | 0.74.0-160000.2.1 | [OPENSUSE-SU-2026:21801-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21801-1.md) | Sep 7, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.