CVE-2026-45680: medium-severity vulnerability in open-telemetry opentelemetry-ebpf-instrumentati…
OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.3%
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metrics exporter to spend excessive CPU time in a tight loop every collection interval. This issue has been patched in version 0.9.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
open-telemetry · opentelemetry-ebpf-instrumentationRelated CVEs — open-telemetry opentelemetry-ebpf-instrumentati…
In the same product, most dangerous first.
CVE-2026-45685HIGHOpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messagesEPSS 0.5%CVE-2026-45686HIGHOpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBIEPSS 0.4%CVE-2026-45678HIGHOpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloadsEPSS 0.3%CVE-2026-45681MEDIUMOpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeEPSS 0.3%CVE-2026-45679MEDIUMOpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messagesEPSS 0.2%CVE-2026-41433HIGHOpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIREPSS 0.2%