CVE-2026-45682CWE-401CWE-770

OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

Medium · published June 2, 2026

CVSS v3.1
5.1
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running instrumented JVMs, repeated connection churn can therefore grow the queue without bound and exhaust heap memory. This issue has been patched in version 0.9.0.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.5th percentile
Weaknesses
CWE-401 · Missing Release of Memory after Effective Lifetime; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-06-02T15:23Z
EPSS history
Timeline
  • 02 JUN 15:23Z
    OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
    cvelistv5