eBPF Instrumentation Vulnerability in OpenTelemetry Affects Postgres Protocol Parsing

CVE-2026-45678

What is CVE-2026-45678?

The OpenTelemetry eBPF Instrumentation contains a vulnerability within the Postgres protocol parser that assumes BIND message payloads always include a valid, NUL-terminated portal name. This assumption can be exploited when an attacker sends a crafted payload that is either empty or not properly terminated, leading to potential buffer overflows. Such exploitation may cause the application to slice beyond the intended buffer, resulting in application panic. This issue was addressed and mitigated in version 0.9.0.

References