CVE-2026-45681

Description

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.

Weakness classification

• security-advisories@github.com: CWE-125

Primary references

• security-advisories@github.com — Product, Release Notes
• security-advisories@github.com — Exploit, Vendor Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory