CVE-2026-45682 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running...

CVE-2026-45292

A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, falco-no-driver, helm, nerdctl, prometheus-operator, step-issuer, terraform-provider-acme, zot, karpenter, crossplane-provider-aws-elasticache, caddy, fq, minio, prometheus, opentelemetry-collector, step, glab, flux, snyk-cli, telegraf, hydra, traefi...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, falco-no-driver, helm, nerdctl, prometheus-operator, step-issuer, terraform-provider-acme, zot, karpenter, crossplane-provider-aws-elasticache, caddy, fq, minio, prometheus, opentelemetry-collector, step, glab, flux, snyk-cli, telegraf, hydra, traefi...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, falco-no-driver, helm, nerdctl, prometheus-operator, step-issuer, terraform-provider-acme, zot, karpenter, crossplane-provider-aws-elasticache, caddy, fq, minio, prometheus, opentelemetry-collector, step, glab, flux, snyk-cli, telegraf, hydra, traefi...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, falco-no-driver, helm, nerdctl, prometheus-operator, step-issuer, terraform-provider-acme, zot, karpenter, crossplane-provider-aws-elasticache, caddy, fq, minio, prometheus, opentelemetry-collector, step, glab, flux, snyk-cli, telegraf, hydra, traefi...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, falco-no-driver, helm, nerdctl, prometheus-operator, step-issuer, terraform-provider-acme, zot, karpenter, crossplane-provider-aws-elasticache, caddy, fq, minio, prometheus, opentelemetry-collector, step, glab, flux, snyk-cli, telegraf, hydra, traefi...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, falco-no-driver, helm, nerdctl, prometheus-operator, step-issuer, terraform-provider-acme, zot, karpenter, crossplane-provider-aws-elasticache, caddy, fq, minio, prometheus, opentelemetry-collector, step, glab, flux, snyk-cli, telegraf, hydra, traefi...

CVE-2026-42502 vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, falco-no-driver, helm, nerdctl, prometheus-operator, step-issuer, terraform-provider-acme, zot, karpenter, crossplane-provider-aws-elasticache, caddy, fq, minio, prometheus, opentelemetry-collector, step, glab, flux, snyk-cli, telegraf, hydra, traefi...

GHSA-5CV4-JP36-H3MW vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, falco-no-driver, helm, nerdctl, prometheus-operator, step-issuer, terraform-provider-acme, zot, karpenter, crossplane-provider-aws-elasticache, caddy, fq, minio, prometheus, opentelemetry-collector, step, glab, flux, snyk-cli, telegraf, hydra, traefi...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, falco-no-driver, helm, nerdctl, prometheus-operator, step-issuer, terraform-provider-acme, zot, karpenter, crossplane-provider-aws-elasticache, caddy, fq, minio, prometheus, opentelemetry-collector, step, glab, flux, snyk-cli, telegraf, hydra, traefi...

CVE-2026-45680: Uncontrolled Resource Consumption

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the Postgres protocol parser’...

CVE-2026-45683: Buffer Under-read

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpfproberead instead of bpfprobereaduser. An instrumented local process can therefore point OBI at kerne...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source, eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the export of raw Redis erro...

CVE-2026-45678: Improper Input Validation

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond th...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the use of a custom...

FORGE: Multi-Agent Graduated Exploitation and Detection Engineering

Vulnerability disclosure volumes now far exceed organizational assessment capacity, yet three adjacent research communities proof-of-concept generation, vulnerability prioritization, and detection rule engineering operate largely in isolation. Existing automated exploit generation systems report...

CVE-2026-45681: Out-of-bounds Read

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can...

CVE-2026-45684: Buffer Over-read

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total ioviter.count as the copy length. When log...