CVE-2026-45681
OpenTelemetry eBPF Instrumentation Memory Leak Vulnerability
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opentelemetry | ebpf_instrumentation | to 0.9.0 (exc) |
| open_telemetry | opentelemetry_ebpf_instrumentation | to 0.9.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-130 | The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in OpenTelemetry eBPF Instrumentation can lead to the leakage of adjacent memory into telemetry data, potentially exposing sensitive information without requiring privileges or user interaction.
Such unintended exposure of sensitive data through telemetry could impact compliance with data protection regulations and standards like GDPR and HIPAA, which mandate the protection of confidential information and the prevention of unauthorized data disclosure.
Therefore, this vulnerability poses a confidentiality risk that could lead to violations of these compliance requirements if exploited.
Can you explain this vulnerability to me?
The vulnerability CVE-2026-45681 in OpenTelemetry eBPF Instrumentation is caused by a buffer size mismatch in the CPU-mismatch fallback path. Normally, the system uses an 8KB per-CPU buffer for operations, but when a CPU mismatch occurs, it switches to a much smaller 256-byte fallback buffer. However, the code still preserves the original payload size of up to 8KB, which leads to an out-of-bounds read because it tries to read more data than the fallback buffer can hold.
This out-of-bounds read can cause adjacent memory to be leaked into telemetry data, potentially exposing sensitive information. The issue specifically affects the HTTP tracing path and happens under certain conditions such as when context propagation is enabled, the tpinjector sock_msg path is active, HTTP large-buffer capture is configured, and a CPU mismatch occurs between producer and consumer contexts.
How can this vulnerability impact me? :
This vulnerability can impact you by leaking adjacent memory contents into telemetry data, which may include sensitive or confidential information. Since the vulnerability involves an out-of-bounds read, it can expose data that should not be accessible through telemetry.
The issue has a moderate severity with a CVSS score of 5.9 and does not require privileges or user interaction to be exploited, making it a confidentiality concern. This means that attackers or unauthorized parties could potentially gain access to sensitive data without needing special permissions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of CVE-2026-45681 involves identifying conditions where the OpenTelemetry eBPF instrumentation is using the fallback buffer path with a CPU mismatch, which leads to out-of-bounds reads and potential memory leakage in telemetry data.
Specifically, detection can focus on monitoring telemetry data for unexpected or suspicious memory content leakage, especially when context propagation is enabled, the tpinjector sock_msg path is active, and HTTP large-buffer capture is configured.
A proof-of-concept exists that simulates the buffer size mismatch in user-space, which could be adapted to test your environment.
However, no explicit commands or direct detection tools are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the OpenTelemetry eBPF instrumentation to version 0.9.0 or later, where the fallback buffer size has been corrected to match the preserved payload size, preventing out-of-bounds reads.
Until the upgrade is applied, consider disabling context propagation, the tpinjector sock_msg path, or HTTP large-buffer capture features if feasible, as these conditions contribute to the vulnerability being exploitable.