chore(core): CVE mitigation 20-05-2026 in CSE

[LopatinDmitr]

Description

• Fix CVE-2026-29181: OpenTelemetry-Go: multi-value baggage header extraction causes excessive
  allocations (remote dos amplification)
• Fix CVE-2026-33811: When using LookupCNAME with the cgo DNS resolver, a very long CNAME...
• Fix CVE-2026-33814: When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
• Fix CVE-2026-39820: Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
• Fix CVE-2026-39823: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
• Fix CVE-2026-39825: ReverseProxy can forward queries containing parameters not visible to ...
• Fix CVE-2026-39826: If a trusted template author were to write a <script> tag containing...
• Fix CVE-2026-39836: Panic in Dial and LookupPort when handling NUL byte on Windows in...
• Fix CVE-2026-41520: Cillium exposes sensitive information included in the cilium-bugtool debug
  archive
• Fix CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing ...

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

Changelog entries

section: core
type: chore
summary: |
  Fixed vulnerability:
  - CVE-2026-29181
  - CVE-2026-33811
  - CVE-2026-33814
  - CVE-2026-39820
  - CVE-2026-39823
  - CVE-2026-39825
  - CVE-2026-39826
  - CVE-2026-39836
  - CVE-2026-41520
  - CVE-2026-42499