OpenTelemetry eBPF Instrumentation Vulnerability Affecting Multiple Systems
CVE-2026-45680

5.9MEDIUM

Key Information:

Vendor

Open-telemetry

Status
Opentelemetry-ebpf-instrumentation
Vendor
CVE Published:
2 June 2026

What is CVE-2026-45680?

The OpenTelemetry eBPF Instrumentation prior to version 0.9.0 contains a vulnerability that can impact the performance of busy systems. This occurs due to a loop that processes BPF probe hits into histogram observations, leading to excessive CPU usage when the run-count delta increases significantly. Such behavior can negatively affect system stability and performance during data collection intervals. The issue has been resolved in version 0.9.0, which optimizes the metrics export process.

Affected Version(s)

opentelemetry-ebpf-instrumentation < 0.9.0

References

https://github.com/open-telemetry/opentelemetry-ebpf-inst...
x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-ebpf-inst...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.