opentelemetry-ebpf-instrumentation

11 results · Feed

• High 7.5
  CVE-2026-45686

  OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• High 7.5
  CVE-2026-45685

  OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthen…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• Medium 4.9
  CVE-2026-45684

  OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.c…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• Low 3.8
  CVE-2026-45683

  OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented loc…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• Medium 5.9
  CVE-2026-45681

  OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8K…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• Medium 5.9
  CVE-2026-45680

  OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta c…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• Medium 6.5
  CVE-2026-45679

  OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• High 7.5
  CVE-2026-45678

  OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminate…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• Medium 5.5
  CVE-2026-45676

  OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can mak…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• Medium 5.1
  CVE-2026-45682

  OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entr…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Jun 2, 2026
• High 8.4
  CVE-2026-41433

  OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

  OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files whe…

  open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  Apr 24, 2026