Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53412 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities (CVE-2026-43870)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53415 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities (CVE-2026-43870)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53413 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities (CVE-2026-43870)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'),     Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'),     Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before     0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. (CVE-2026-43870)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
334550	RHEL 9 : opentelemetry-collector (RHSA-2026:53412)	Nessus	Red Hat Local Security Checks	Local	high
334549	RHEL 9 : opentelemetry-collector (RHSA-2026:53415)	Nessus	Red Hat Local Security Checks	Local	high
334538	RHEL 10 : opentelemetry-collector (RHSA-2026:53413)	Nessus	Red Hat Local Security Checks	Local	high
312203	Linux Distros Unpatched Vulnerability : CVE-2026-43870	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-43870

high

Tenable Plugins

high

high

high

high