CVE-2026-45676

CVE-2026-45676 affects OpenTelemetry eBPF Instrumentation (OBI). Before version 0.9.0, OBI’s replacement ELF parser trusts section offsets, counts, and string offsets from the executable, allowing a crafted local ELF to trigger invalid dereferences or out-of-bounds slicing in the parser. The vuln...

CVE-2026-45676 OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can make OBI dereference invalid section...

EUVD-2026-33950

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running...

CVE-2026-45682 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running...

CVE-2026-45682

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running...

CVE-2026-45682 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running...

CVE-2026-45682

OpenTelemetry eBPF Instrumentation CVE-2026-45682 describes a leak in CappedConcurrentHashMap used for Java TLS state tracking: when entries are deleted, keys are not removed from the insertion-order queue, allowing the queue to grow in long-running instrumented JVMs. The issue causes heap exhaus...

CVE-2026-45682 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running...

CVE-2026-45292

A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

GHSA-5CV4-JP36-H3MW vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-42502 vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source, eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the export of raw Redis erro...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the Postgres protocol parser’...