CVE-2026-45682

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running instrumented JVMs, repeated connection churn can therefore grow the queue without bound and exhaust heap memory. This issue has been patched in version 0.9.0.

CVSS v3 5.1 MEDIUM

5.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.4 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0	Product Release Notes
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-962q-hwm5-52x5	Exploit Vendor Advisory
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-962q-hwm5-52x5	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-06-02 16:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-45682

Mitre link : CVE-2026-45682

CVE.ORG link : CVE-2026-45682

JSON object : View

Products Affected

opentelemetry

ebpf_instrumentation

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-45682", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45682", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T17:19:08.840062Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-telemetry", "product": "opentelemetry-ebpf-instrumentation", "versions": [{"status": "affected", "version": "< 0.9.0"}]}]}], "published": "2026-06-02T16:16:42.897", "references": [{"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-962q-hwm5-52x5", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-962q-hwm5-52x5", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-401"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running instrumented JVMs, repeated connection churn can therefore grow the queue without bound and exhaust heap memory. This issue has been patched in version 0.9.0."}, {"lang": "es", "value": "OpenTelemetry eBPF Instrumentation proporciona instrumentaci\u00f3n eBPF basada en el est\u00e1ndar OpenTelemetry. Antes de la versi\u00f3n 0.9.0, el CappedConcurrentHashMap personalizado introducido para el seguimiento del estado TLS de Java nunca elimina claves de su cola de orden de inserci\u00f3n cuando se eliminan entradas. En JVMs instrumentadas de larga duraci\u00f3n, la rotaci\u00f3n repetida de conexiones puede, por lo tanto, hacer crecer la cola sin l\u00edmite y agotar la memoria del mont\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 0.9.0."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "72CC55EE-4DFB-417E-B148-642944DFC24F", "versionEndExcluding": "0.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}