Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-48496 EUVD-2026-76762GHSA-f2r5-5m7w-p5cxGO-2026-5343

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

Published Sep 11, 2026 · Updated Sep 14, 2026 · Assigned by GitHub_M

Vendor: open-telemetry Product: opentelemetry-ebpf-profiler Package: go.opentelemetry.io/ebpf-profiler Ecosystem: Go

Description

OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-ebpf-profiler >= 0.0.202527, < 0.0.202622 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 alloy 1.19.2-150700.15.29.1 SUSE-SU-2026:4408-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 alloy 1.19.2-160000.1.1 SUSE-SU-2026:24148-1
SLES 16.0 alloy 1.19.2-160000.1.1 SUSE-SU-2026:24148-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed alloy 1.19.2-1.1 openSUSE-SU-2026:11803-1
openSUSE Leap 16.0 alloy 1.19.2-160000.1.1 openSUSE-SU-2026:22032-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go go.opentelemetry.io/ebpf-profiler >= 0.0.202527, < 0.0.202622 0.0.202622 GHSA-f2r5-5m7w-p5cx

Advisories 5

References