CVE-2026-45681

Summary

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.

Affected Software

VendorProductVersion RangeStatus
open-telemetryopentelemetry-ebpf-instrumentation< 0.9.0affected

Weaknesses

  • CWE-125: CWE-125: Out-of-bounds Read
  • CWE-130: CWE-130: Improper Handling of Length Parameter Inconsistency

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

Additional References

References