CVE-2026-45678CWE-20CWE-754

OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

High · published June 2, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00515 · 43.0th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2026-06-02T15:24Z
EPSS history
Timeline
  • 02 JUN 15:24Z
    OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
    cvelistv5