CVE-2026-45678

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0	Product Release Notes
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-pgvv-q3wf-mm9m	Exploit Vendor Advisory
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-pgvv-q3wf-mm9m	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-06-02 16:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-45678

Mitre link : CVE-2026-45678

CVE.ORG link : CVE-2026-45678

JSON object : View

Products Affected

opentelemetry

ebpf_instrumentation

CWE

CWE-20

Improper Input Validation

CWE-754

Improper Check for Unusual or Exceptional Conditions

{"id": "CVE-2026-45678", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45678", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T15:54:02.639290Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-telemetry", "product": "opentelemetry-ebpf-instrumentation", "versions": [{"status": "affected", "version": "< 0.9.0"}]}]}], "published": "2026-06-02T16:16:42.287", "references": [{"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-pgvv-q3wf-mm9m", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-pgvv-q3wf-mm9m", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0."}, {"lang": "es", "value": "OpenTelemetry eBPF Instrumentation proporciona instrumentaci\u00f3n eBPF basada en el est\u00e1ndar OpenTelemetry. Antes de la versi\u00f3n 0.9.0, el analizador del protocolo Postgres asume que las cargas \u00fatiles de los mensajes BIND contienen un nombre de portal v\u00e1lido terminado en NUL. Una carga \u00fatil manipulada vac\u00eda o sin terminar puede hacer que OBI rebase el final del b\u00fafer capturado y entre en p\u00e1nico. Este problema ha sido parcheado en la versi\u00f3n 0.9.0."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "72CC55EE-4DFB-417E-B148-642944DFC24F", "versionEndExcluding": "0.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}