RHSA-2026:67138 – Vulnerabilities in HTML processing and OpenTelemetry-Go baggage headers

The source describes four related vulnerabilities. Specially crafted HTML processed and rendered by golang.org/x/net/html can produce an unexpected HTML tree, allowing HTML sanitization bypasses and XSS attacks. OpenTelemetry-Go may suffer a denial of service when processing oversized or invalid baggage headers.