CVE-2026-45678CWE-20CWE-754
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
High · published June 2, 2026
What it is
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00515 · 43.0th percentile
- Weaknesses
- CWE-20 · Improper Input Validation; CWE-754 · Improper Check for Unusual or Exceptional Conditions
- Published
- 2026-06-02T15:24Z
EPSS history
Timeline