Skip to content
OpenAdvisories
High · 7.5 CVE-2026-45686 EUVD-2026-33959GHSA-43g7-cwr8-q3jhGO-2026-5107

OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

Published Jun 2, 2026 · Updated Jun 3, 2026 · Assigned by GitHub_M

Description

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as set, add, replace, append, prepend, or cas, OBI accepts extremely large <bytes> values and adds the payload delimiter length without checking for overflow. A crafted request with <bytes> set to math.MaxInt or math.MaxInt-1 causes the computed payload length to wrap negative and triggers a runtime panic in LargeBufferReader.Peek. This issue has been patched in version 0.9.0.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-ebpf-instrumentation >= 0.7.0, < 0.9.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SLES 15 SP7 alloy 1.17.1-150700.15.23.1 SUSE-SU-2026:2824-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 alloy 1.17.0-160000.1.1 SUSE-SU-2026:22575-1
SLES 16.0 alloy 1.17.0-160000.1.1 SUSE-SU-2026:22575-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed alloy 1.17.0-1.1 openSUSE-SU-2026:11053-1
openSUSE Leap 16.0 alloy 1.17.0-160000.1.1 openSUSE-SU-2026:21251-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go go.opentelemetry.io/obi >= 0.7.0, < 0.9.0 0.9.0 GHSA-43g7-cwr8-q3jh

Advisories 5

References