CVE-2026-45680: OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
Vulnerability summary
CVE-2026-45680 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in open-telemetry opentelemetry-ebpf-instrumentation. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 02-06-2026PublishedVulnerability first disclosed.
- 03-06-2026Last modifiedVulnerability information updated.
Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metrics exporter to spend excessive CPU time in a tight loop every collection interval. This issue has been patched in version 0.9.0.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
Decrease -0.16 pp
From 0.48% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundOpentelemetry Ebpf Instrumentation
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Go.opentelemetry.io1 product
- obi< 0.9.0
Open-telemetry1 product
Opentelemetry1 product
- ebpf_instrumentation< 0.9.0
3 vendors · 3 products
References
4 links- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-89c6-vpcj-7vj4X Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0X Refsource MISCWEBProductRelease Notes
