CVE-2026-45682

OpenTelemetry eBPF Instrumentation CVE-2026-45682 describes a leak in CappedConcurrentHashMap used for Java TLS state tracking: when entries are deleted, keys are not removed from the insertion-order queue, allowing the queue to grow in long-running instrumented JVMs. The issue causes heap exhaus...

CVE-2026-45682 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running...

CVE-2026-45682 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running...

CVE-2026-45292

A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: nerdctl, snyk-cli, k3s, zot, istio, minio, prometheus, ingress-nginx-controller, step-issuer, opentelemetry-collector, glab, grafana-pyroscope, kots, terraform-provider-acme, kubernetes-dashboard, traefik, caddy, step, prometheus-operator, fq, helm,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: nerdctl, snyk-cli, k3s, zot, istio, minio, prometheus, ingress-nginx-controller, step-issuer, opentelemetry-collector, glab, grafana-pyroscope, kots, terraform-provider-acme, kubernetes-dashboard, traefik, caddy, step, prometheus-operator, fq, helm,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: nerdctl, snyk-cli, k3s, zot, istio, minio, prometheus, ingress-nginx-controller, step-issuer, opentelemetry-collector, glab, grafana-pyroscope, kots, terraform-provider-acme, kubernetes-dashboard, traefik, caddy, step, prometheus-operator, fq, helm,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: nerdctl, snyk-cli, k3s, zot, istio, minio, prometheus, ingress-nginx-controller, step-issuer, opentelemetry-collector, glab, grafana-pyroscope, kots, terraform-provider-acme, kubernetes-dashboard, traefik, caddy, step, prometheus-operator, fq, helm,...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: nerdctl, snyk-cli, k3s, zot, istio, minio, prometheus, ingress-nginx-controller, step-issuer, opentelemetry-collector, glab, grafana-pyroscope, kots, terraform-provider-acme, kubernetes-dashboard, traefik, caddy, step, prometheus-operator, fq, helm,...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: nerdctl, snyk-cli, k3s, zot, istio, minio, prometheus, ingress-nginx-controller, step-issuer, opentelemetry-collector, glab, grafana-pyroscope, kots, terraform-provider-acme, kubernetes-dashboard, traefik, caddy, step, prometheus-operator, fq, helm,...

GHSA-5CV4-JP36-H3MW vulnerabilities

Vulnerabilities for packages: nerdctl, snyk-cli, k3s, zot, istio, minio, prometheus, ingress-nginx-controller, step-issuer, opentelemetry-collector, glab, grafana-pyroscope, kots, terraform-provider-acme, kubernetes-dashboard, traefik, caddy, step, prometheus-operator, fq, helm,...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: nerdctl, snyk-cli, k3s, zot, istio, minio, prometheus, ingress-nginx-controller, step-issuer, opentelemetry-collector, glab, grafana-pyroscope, kots, terraform-provider-acme, kubernetes-dashboard, traefik, caddy, step, prometheus-operator, fq, helm,...

CVE-2026-42502 vulnerabilities

Vulnerabilities for packages: nerdctl, snyk-cli, k3s, zot, istio, minio, prometheus, ingress-nginx-controller, step-issuer, opentelemetry-collector, glab, grafana-pyroscope, kots, terraform-provider-acme, kubernetes-dashboard, traefik, caddy, step, prometheus-operator, fq, helm,...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the Postgres protocol parser’...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source, eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the export of raw Redis erro...

FORGE: Multi-Agent Graduated Exploitation and Detection Engineering

Vulnerability disclosure volumes now far exceed organizational assessment capacity, yet three adjacent research communities proof-of-concept generation, vulnerability prioritization, and detection rule engineering operate largely in isolation. Existing automated exploit generation systems report...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. There were security vulnerabilities in the version of OpenTelemetry eBPF Instrumentation from 0.7.0 to 0.9.0. These vulnerabilities stemmed from the log enhancer’...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the use of a custom...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the use of a 256-byte backup...

OpenTelemetry eBPF Instrumentation 安全漏洞

OpenTelemetry eBPF Instrumentation is an open-source, eBPF-based lightweight telemetry data collection tool developed by OpenTelemetry. Versions of OpenTelemetry eBPF Instrumentation prior to 0.9.0 contained security vulnerabilities. These vulnerabilities stemmed from the Java TLS ioctl probe usi...