Skip to content
OpenAdvisories

Package · Go

go.opentelemetry.io/obi

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-45684

    OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.c…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  • Medium 5.9
    CVE-2026-45681

    OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8K…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  • Medium 5.9
    CVE-2026-45680

    OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta c…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  • Medium 6.5
    CVE-2026-45679

    OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  • Medium 5.5
    CVE-2026-45676

    OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can mak…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  • Medium 5.1
    CVE-2026-45682

    OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entr…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go