{"id":"EUVD-2026-42324","enisaUuid":"ea54acfb-8ffb-3269-84ce-e60d72169c17","description":"OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.","datePublished":"Jul 8, 2026, 4:03:58 PM","dateUpdated":"Jul 8, 2026, 7:41:27 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr\nhttps://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88\nhttps://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0\n","aliases":"CVE-2026-59892\nGHSA-45rx-2jwx-cxfr\n","assigner":"GitHub_M","epss":0.56,"enisaIdProduct":[{"id":"3a67a5dc-2285-33a9-b61c-3f8f75fd9bd1","product":{"name":"opentelemetry-js","vendor":{"name":"open-telemetry"}},"product_version":"\u003c 2.9.0"}],"enisaIdVendor":[{"id":"a613bc54-fa4d-3a0d-8956-6a8eed30bb0a","vendor":{"name":"open-telemetry"}}],"enisaIdVulnerability":[{"id":"39f71597-fd7e-3c1b-9fae-691bac0435fc","vulnerability":{"id":"GHSA-45rx-2jwx-cxfr","description":"OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header","datePublished":"Jul 21, 2026, 7:07:28 PM","dateUpdated":"Jul 21, 2026, 7:07:28 PM","baseScore":0.0,"references":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59892\nhttps://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88\nhttps://github.com/open-telemetry/opentelemetry-js\nhttps://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0\n","enisa_id":"EUVD-2026-42324\n","aliases":"CVE-2026-59892\nGHSA-45rx-2jwx-cxfr\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:58:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"932e6fce-7375-3ad6-ace5-8a0c7706c355","vulnerability":{"id":"CVE-2026-59892","description":"OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.","datePublished":"Jul 8, 2026, 4:03:58 PM","dateUpdated":"Jul 8, 2026, 7:41:27 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr\nhttps://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88\nhttps://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0\n","enisa_id":"EUVD-2026-42324\n","assigner":"GitHub_M","epss":0.56,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"14984606-4e44-32d3-b5ae-c9d9639f714d","product":{"name":"opentelemetry-js","vendor":{"name":"open-telemetry"}},"product_version":"\u003c 2.9.0"}],"vulnerabilityVendor":[{"id":"a96f1ee5-6ad5-30d3-8a22-2ff14568eb2f","vendor":{"name":"open-telemetry"}}]}}],"enisaIdAdvisory":[{"id":"3d98e1a3-d04b-3c70-8e7c-052d2a7276bd","advisory":{"id":"RHSA-2026:52768","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.8 release.","summary":"Red Hat Developer Hub 1.9.8 has been released.","datePublished":"Aug 10, 2026, 9:41:59 AM","dateUpdated":"Oct 23, 2026, 5:33:36 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:52768\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52768.json\n","aliases":"CVE-2026-5038\nCVE-2026-5079\nCVE-2026-13149\nCVE-2026-46625\nCVE-2026-48068\nCVE-2026-48069\nCVE-2026-48712\nCVE-2026-49978\nCVE-2026-59869\nCVE-2026-59877\nCVE-2026-59892\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"19ce4568-0720-3b97-8aab-39deadad56b9","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb8c0beabdebee8c0bebdab9af6931f6ff2d3a7e063c6c76841463ec9fb66491_amd64","vendor":{"name":"Red Hat"}}},{"id":"5f646594-09a9-373b-8c6a-94cf192557be","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:c7a8301849b2b5833207b7cb1c2cdd05e93d303e92636d8ca2932b4c2ea23c5c_amd64","vendor":{"name":"Red Hat"}}},{"id":"c4c383f7-cc9b-3e0a-a2cb-615030348881","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:7f831e5f23c8ea87704e9cdacd5669e83b075243e048d4c797e3a1bb14569840_amd64","vendor":{"name":"Red Hat"}}},{"id":"d27de10b-20b2-3305-951a-6e6f42a101aa","product":{"name":"Red Hat Developer Hub 1.9","vendor":{"name":"Red Hat"}}}]}},{"id":"8a519ac4-c612-39be-9740-0840e6c9414e","advisory":{"id":"RHSA-2026:49642","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 release.","summary":"Red Hat Developer Hub 1.10.3 has been released.","datePublished":"Aug 3, 2026, 10:03:58 AM","dateUpdated":"Oct 23, 2026, 5:24:28 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:49642\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49642.json\n","aliases":"CVE-2026-5038\nCVE-2026-5079\nCVE-2026-13149\nCVE-2026-13676\nCVE-2026-42504\nCVE-2026-45740\nCVE-2026-46625\nCVE-2026-48068\nCVE-2026-48069\nCVE-2026-48801\nCVE-2026-49978\nCVE-2026-59869\nCVE-2026-59877\nCVE-2026-59892\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"1ae6cb3d-6a30-3e96-9d4e-e0caa06e0100","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64","vendor":{"name":"Red Hat"}}},{"id":"797baa50-c666-33e7-83a1-84660051d8d9","product":{"name":"registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64","vendor":{"name":"Red Hat"}}},{"id":"a2372c35-ffb0-3350-aa95-4f2a376d843d","product":{"name":"registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64","vendor":{"name":"Red Hat"}}},{"id":"aa8e8f87-8dd9-36e2-936c-fa90fa023256","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64","vendor":{"name":"Red Hat"}}},{"id":"be2ab6c6-1071-3b22-afb9-93497a2570bc","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64","vendor":{"name":"Red Hat"}}},{"id":"ce3296c0-28ae-3e81-9f4c-ab151cff551b","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}}]}}]}