{"schemaVersion":3,"id":"CVE-2026-48496","aliases":["GHSA-f2r5-5m7w-p5cx","GO-2026-5343","CGA-22jc-cvpp-cjfm","CGA-2jp6-pf4g-p57q","CGA-35x6-84m8-8wfw","CGA-3mqc-8c2j-r3mp","CGA-3mxv-v9q9-49fx","CGA-49v3-3g3f-jgv5","CGA-5mr5-2v4f-cmjw","CGA-75wf-2wqv-j2f8","CGA-8r2c-9c8f-mjxr","CGA-952v-vhjj-gg8p","CGA-9w66-r24g-hg2c","CGA-f28f-c364-jjjv","CGA-frfq-q97h-3jjv","CGA-g7x5-4x86-p94r","CGA-g8ff-97f4-67rv","CGA-ggx9-97wc-943w","CGA-hgj4-8xwv-j327","CGA-mcmg-mcg4-wx9r","CGA-pm48-h54g-q4rx","CGA-qggx-vf7q-5r79","CGA-wqgw-c69p-p2jw","CGA-xj2w-f3pf-xc92","CGA-xvmq-pw7q-f3w9"],"status":"published","duplicateOf":null,"title":"opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent","description":"OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.","dates":{"published":"2026-09-11T21:16:42.934Z","modified":"2026-09-14T19:55:59.052Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.2,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":6.4,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":6.4,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00137,"percentile":0.02832,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":-0.0020000000000000052,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00139},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00137,"percentile":0.02832}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00139,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00184,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00137,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00137,"percentile":0.02832}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"chainguard","product":"elastic-agent-8.19","name":"elastic-agent-8.19","label":"elastic-agent-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-agent-8.19","purlType":"apk","versions":[{"text":"< 8.19.17-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.17-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"elastic-agent-9.1","name":"elastic-agent-9.1","label":"elastic-agent-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-agent-9.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"elastic-agent-9.2","name":"elastic-agent-9.2","label":"elastic-agent-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-agent-9.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"elastic-agent-fips-8.19","name":"elastic-agent-fips-8.19","label":"elastic-agent-fips-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-agent-fips-8.19","purlType":"apk","versions":[{"text":"< 8.19.18-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 8.19.18-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 8.19.17-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.18-r1 | < 8.19.18-r0 | < 8.19.17-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"elastic-agent-fips-9.1","name":"elastic-agent-fips-9.1","label":"elastic-agent-fips-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-agent-fips-9.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"elastic-agent-fips-9.2","name":"elastic-agent-fips-9.2","label":"elastic-agent-fips-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-agent-fips-9.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"elastic-otel-collector-9.3","name":"elastic-otel-collector-9.3","label":"elastic-otel-collector-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-otel-collector-9.3","purlType":"apk","versions":[{"text":"< 9.3.8-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.8-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"elastic-otel-collector-9.4","name":"elastic-otel-collector-9.4","label":"elastic-otel-collector-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-otel-collector-9.4","purlType":"apk","versions":[{"text":"< 9.4.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"elastic-otel-collector-fips-9.3","name":"elastic-otel-collector-fips-9.3","label":"elastic-otel-collector-fips-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-otel-collector-fips-9.3","purlType":"apk","versions":[{"text":"< 9.3.8-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.8-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"elastic-otel-collector-fips-9.4","name":"elastic-otel-collector-fips-9.4","label":"elastic-otel-collector-fips-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/elastic-otel-collector-fips-9.4","purlType":"apk","versions":[{"text":"< 9.4.2-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r3","eol":null,"hubHref":null},{"vendor":"go.opentelemetry.io","product":"ebpf-profiler","name":"go.opentelemetry.io/ebpf-profiler","label":"ebpf-profiler","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/go.opentelemetry.io/ebpf-profiler","purlType":"golang","versions":[{"text":"≥ 0.0.202527, < 0.0.202622","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.0.202527, < 0.0.202622","eol":null,"hubHref":null},{"vendor":"open-telemetry","product":"opentelemetry-ebpf-profiler","name":"opentelemetry-ebpf-profiler","label":"opentelemetry-ebpf-profiler","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.0.202527, < 0.0.202622","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.0.202527, < 0.0.202622","eol":null,"hubHref":"/vendor/open-telemetry/opentelemetry-ebpf-profiler"}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/open-telemetry/opentelemetry-ebpf-profiler/security/advisories/GHSA-f2r5-5m7w-p5cx","label":"github.com/open-telemetry/opentelemetry-ebpf-profiler/security/advisories/GHSA-f2r5-5m7w-p5cx","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-ebpf-profiler/commit/234b685cab31c2cb2f79e966caeab168bcc489e4","label":"github.com/open-telemetry/…","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/open-telemetry/opentelemetry-ebpf-profiler/releases/tag/v0.0.202622","label":"github.com/open-telemetry/opentelemetry-ebpf-profiler/releases/tag/v0.0.202622","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/open-telemetry/opentelemetry-ebpf-profiler","label":"github.com/open-telemetry/opentelemetry-ebpf-profiler","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:11803-1","OPENSUSE-SU-2026:21483-1","OPENSUSE-SU-2026:22032-1","SUSE-SU-2026:24148-1","SUSE-SU-2026:4408-1"],"duplicates":[],"related":["CGA-5X9P-96M4-669M","OPENSUSE-SU-2026:11803-1","OPENSUSE-SU-2026:21483-1","OPENSUSE-SU-2026:22032-1","SUSE-SU-2026:24148-1","SUSE-SU-2026:4408-1"]},"timeline":[{"kind":"published","date":"2026-09-11T21:16:42.934Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-14T19:55:59.052Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T21:46:41.875Z","stale":false,"partial":false}}