CVE-2026-45681: OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size
Vulnerability summary
CVE-2026-45681 is a medium (CVSS 5.9) Out-of-bounds Read vulnerability in open-telemetry opentelemetry-ebpf-instrumentation. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.3% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 02-06-2026PublishedVulnerability first disclosed.
- 02-06-2026Last modifiedVulnerability information updated.
Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
Decrease -0.09 pp
From 0.38% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundOpentelemetry Ebpf Instrumentation
Maturity: poc
Weaknesses
CWE · root cause- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Go.opentelemetry.io1 product
- obi< 0.9.0
Open-telemetry1 product
Opentelemetry1 product
- ebpf_instrumentation< 0.9.0
3 vendors · 3 products
References
4 links- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-r6c9-g6q5-qrf9X Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0X Refsource MISCWEBProductRelease Notes
