Security Digest: April 7, 2026 - 3 Critical Vulnerabilities

Today, three significant vulnerabilities have been identified that demand immediate attention: a trust-bypass in mise, an HTTP redirect loop in @fedify/fedify, and an amplification issue in OpenTelemetry.

· 3 min read

Today's Threats: Immediate Actions Required

Executive Summary

Today, three significant vulnerabilities have been identified that demand immediate attention: a trust-bypass in mise, an HTTP redirect loop in @fedify/fedify, and an amplification issue in OpenTelemetry. Each poses a high risk of exploitation and resource depletion.

Critical Vulnerabilities

  • CVE-2026-35533: Trust Bypass in mise
    • Impact: Malicious code execution through trust bypass.
    • Affected Systems: mise v2026.3.17
    • Immediate Action: Restrict or remove local `.mise.toml` trust-control settings.
    • Mitigation: Update settings parsing to ignore trust-control fields in non-global configs.
  • CVE-2026-34148: Redirect Loop in @fedify/fedify
    • Impact: Denial of service via excessive HTTP requests.
    • Affected Systems: @fedify/fedify 1.9.1 and 1.9.2
    • Immediate Action: Implement a redirect cap in document loaders.
    • Mitigation: Apply patches to enforce redirect limits and loop detection.
  • CVE-2026-29181: Baggage Header Amplification in OpenTelemetry
    • Impact: Resource exhaustion through repeated header parsing.
    • Affected Systems: OpenTelemetry Go SDK
    • Immediate Action: Limit total parse bytes for multiple baggage headers.
    • Mitigation: Normalize multi-value headers to a single value before parsing.

What to Do Now

  1. Audit your systems for versions affected by these CVEs and update to patched releases immediately.
  2. Verify that any temporary mitigations are in place and functioning as expected.
  3. Implement enhanced monitoring to detect potential exploit attempts, such as unusual outbound network traffic or spikes in resource usage.

Related Resources

Keep reading