CVE-2026-45681CWE-125CWE-130

OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

Medium · published June 2, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.1th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-130 · Improper Handling of Length Parameter Inconsistency
Published
2026-06-02T15:25Z
EPSS history
Timeline
  • 02 JUN 15:25Z
    OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size
    cvelistv5