CVE-2026-45681

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0	Product Release Notes
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-r6c9-g6q5-qrf9	Exploit Vendor Advisory
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-r6c9-g6q5-qrf9	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-06-02 16:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-45681

Mitre link : CVE-2026-45681

CVE.ORG link : CVE-2026-45681

JSON object : View

Products Affected

opentelemetry

ebpf_instrumentation

CWE

CWE-125

Out-of-bounds Read

CWE-130

Improper Handling of Length Parameter Inconsistency

{"id": "CVE-2026-45681", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45681", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T18:05:10.631730Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-telemetry", "product": "opentelemetry-ebpf-instrumentation", "versions": [{"status": "affected", "version": "< 0.9.0"}]}]}], "published": "2026-06-02T16:16:42.753", "references": [{"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-r6c9-g6q5-qrf9", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-r6c9-g6q5-qrf9", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-130"}]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0."}, {"lang": "es", "value": "La Instrumentaci\u00f3n OpenTelemetry eBPF proporciona instrumentaci\u00f3n eBPF basada en el est\u00e1ndar OpenTelemetry. Antes de la versi\u00f3n 0.9.0, la ruta de respaldo del b\u00fafer de mensajes por CPU utiliza un b\u00fafer de respaldo de 256 bytes pero conserva el tama\u00f1o original de la carga \u00fatil, que puede ser de hasta 8KB. Si se produce una discrepancia de CPU, OBI puede leer m\u00e1s all\u00e1 del b\u00fafer de respaldo y filtrar memoria adyacente en la telemetr\u00eda. Este problema ha sido parcheado en la versi\u00f3n 0.9.0."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "72CC55EE-4DFB-417E-B148-642944DFC24F", "versionEndExcluding": "0.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}