CVE-2026-39882

overview: this report shows that the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap.

this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection).

severity

HIGH

not claiming: this is a remote dos against every default deployment. claiming: if the exporter sends traces to an untrusted collector endpoint (or over a network segment where mitm is realistic), that endpoint can crash the process via a large response body.

callsite (pinned):

• exporters/otlp/otlptrace/otlptracehttp/client.go:199
• exporters/otlp/otlptrace/otlptracehttp/client.go:230
• exporters/otlp/otlpmetric/otlpmetrichttp/client.go:170
• exporters/otlp/otlpmetric/otlpmetrichttp/client.go:201
• exporters/otlp/otlplog/otlploghttp/client.go:190
• exporters/otlp/otlplog/otlploghttp/client.go:221

permalinks (pinned):

• https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L199
• https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L230
• https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L170
• https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L201
• https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L190
• https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L221

root cause: each exporter client reads resp.Body using io.Copy(&respData, resp.Body) into a bytes.Buffer on both success and error paths, with no upper bound.

impact: a malicious collector can force large transient heap allocations during export (peak memory scales with attacker-chosen response size) and can potentially crash the instrumented process (oom).

affected component:

• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
• go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp

repro (local-only):

unzip poc.zip -d poc
cd poc
make canonical resp_bytes=33554432 chunk_delay_ms=0

expected output contains:

[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[PROOF_MARKER]: resp_bytes=33554432 peak_alloc_bytes=118050512

control (same env, patched target):

unzip poc.zip -d poc
cd poc
make control resp_bytes=33554432 chunk_delay_ms=0

expected control output contains:

[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[NC_MARKER]: resp_bytes=33554432 peak_alloc_bytes=512232

attachments: poc.zip (attached)

PR_DESCRIPTION.md

attack_scenario.md

poc.zip

Fixed in: https://github.com/open-telemetry/opentelemetry-go/pull/8108

Root has patched CVE-2026-39882 in the rootio-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp package for Root:Go. Multiple fixed versions available.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

The OTLP HTTP exporters (traces, metrics, and logs) do not limit the size of the HTTP response body read from the collector. A malicious or misconfigured collector can send a large response body, leading to excessive memory consumption and potential process termination (OOM).

These are all security issues fixed in the grafana-12.4.5-4.1 package on the GA media of openSUSE Tumbleweed.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

This update for grafana fixes the following issues:

Changes in grafana:

Update to version 12.4.10:

• Security:

  • CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
  • CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
  • CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
  • CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

• Bug fixes:

  • Dashboards: Fix adhoc and groupby variable datasource on UI import
  • Dashboards: Fix version dates and user display names in the legacy version history page

Update to version 12.4.9:

• Features and enhancements:

  • Dashboard Import: Labels in v2 schema

• Bug fixes:

  • Azure Monitor: fix migration for dimension filters

Update to version 12.4.8:

• Security:

  • CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

Update to version 12.4.7:

• Security:

  • CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)

• Features and enhancements:

  • Dashboards: Get annotations and dashboard endpoint performance improvements

• Bug fixes:

  • DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

Update to version 12.4.6:

• Security:

  • CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

• Features and enhancements:

  • Alerting: Add protected fields authorization check to provisioning API
  • Alerting: Return 403 instead of 500 on contact point provenance mismatch

• Bug fixes:

  • Jaeger: Handle gzip, deflate, and brotli compressed API responses
  • Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217)

• CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)

• CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)

• CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)

• CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

• CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)

• CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

This update for containerd fixes the following issues:

• CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP response body reading (bsc#1274214).
• CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).
• CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation (bsc#1268430).
• CVE-2026-53493: a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability (bsc#1282669).
• CVE-2026-53495: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service (bsc#1280007).
• CVE-2026-95838: github.com/containerd/containerd: processing of certain image layers causes superlinear time complexity in unpack handler and can lead to DoS (bsc#1285124).

This update fixes the following issues:

golang-github-prometheus-alertmanager:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)

golang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4:

• Security fixes:

  • CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
  • CVE-2026-33244: Fix improper neutralization of the HTTP Location header value in react-router (bsc#1267416)
  • CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
  • CVE-2026-33814: Fix infinite loop in HTTP/2 transport (bsc#1265827)

• Other bugs fixed and changes:

  • STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint
  • Chore: Bump golang.org/x/net to version 0.55.0

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

This update fixes the following issues:

prometheus-postgres_exporter:

• CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass and privilege escalation (bsc#1248699)

golang-github-prometheus-alertmanager:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)

golang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:

Security fixes:

• CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
• CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router (bsc#1267416)
• CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
• CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827)

Other changes and fixes:

• STACKIT SD: Fixed secrets being exposed in plaintext via /-/config endpoint
• Chore: Bump golang.org/x/net to version 0.55.0

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

This update for grafana fixes the following issues:

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

• Security issues:

  • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
  • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
  • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
  • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
  • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
  • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
  • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
  • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
  • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
  • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
  • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
  • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
  • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

• Bug fixes and changes:

  • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
  • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
  • Native Histograms are no longer experimental. They are fully supported for production workloads.
  • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
  • TSDB compaction speed optimized by improving the block merging algorithm.
  • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
  • Added new metrics to monitor the health of the rule evaluation engine.
  • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
  • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
  • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
  • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
  • Support exporting TSDB blocks directly to cloud storage via the admin API.
  • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
  • Significant query performance boost for high-cardinality regex matchers.
  • Introduce a new UI interface for safely deleting specific time series data directly.
  • Added dynamic relabeling actions to extract substrings using regex capture groups.
  • Fixed UI displaying incorrect time ranges after a timezone change.
  • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

• Security issues:

  • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
  • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…

This update for grafana, system-user-grafana fixes the following issues:

• Update to version 12.4.10:

  • Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)
  • Bug fixes: Dashboards: Fix adhoc and groupby variable datasource on UI import Dashboards: Fix version dates and user display names in the legacy version history page

• Update to version 12.4.9:

  • Features and enhancements: Dashboard Import: Labels in v2 schema
  • Bug fixes: Azure Monitor: fix migration for dimension filters

• Update to version 12.4.8:

  • Security: CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

• Update to version 12.4.7:

  • Security: CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)
  • Features and enhancements: Dashboards: Get annotations and dashboard endpoint performance improvements
  • Bug fixes: DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

• Update to version 12.4.6:

  • Security: CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)
  • Features and enhancements: Alerting: Add protected fields authorization check to provisioning API Alerting: Return 403 instead of 500 on contact point provenance mismatch
  • Bug fixes: Jaeger: Handle gzip, deflate, and brotli compressed API responses Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• Drop 0005-Bump-edwards25519.patch

  CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217) CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557) CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868) CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328) CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763) CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

  • CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
  • CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

• Build only for SUSE distributions

This update for containerd fixes the following issues:

• CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP response body reading (bsc#1274214).
• CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).
• CVE-2026-53493: a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability (bsc#1282669).
• CVE-2026-53495: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service (bsc#1280007).
• CVE-2026-95838: github.com/containerd/containerd: processing of certain image layers causes superlinear time complexity in unpack handler and can lead to DoS (bsc#1285124).