3.8
Low
CVE-2026-45683 OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard
Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| opentelemetry-ebpf-instrumentation 0.9 | earliest → < 0.9.0 | 0.9.0 |
Other CVEs of opentelemetry-ebpf-instrumentation
The 11 CVEs of opentelemetry-ebpf-instrumentation →
CVE-2026-45686
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard
7.5
High
CVE-2026-45685
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard
7.5
High
CVE-2026-45684
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard
4.9
Medium
CVE-2026-45681
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard
5.9
Medium