Red Hat Openshift Distributed Tracing 3.5.3 vulnerabilities

3 CVEs affecting Red Hat Openshift Distributed Tracing 3.5.3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-7425, published 2025-07-10.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-7425, published 2025-07-10. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree…
• CVE-2025-2842, published 2025-04-02. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the…
• CVE-2025-2786, published 2025-04-02. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with…