eBPF Instrumentation Vulnerability in OpenTelemetry by OpenTelemetry
CVE-2026-45684

4.9MEDIUM

Key Information:

Vendor

Open-telemetry

Status
Opentelemetry-ebpf-instrumentation
Vendor
CVE Published:
2 June 2026

What is CVE-2026-45684?

The OpenTelemetry eBPF Instrumentation has a vulnerability that stems from improper handling of writev buffers within the log enricher. Specifically, it fails to correctly process multiple segments of data due to using the total count of the iov_iter rather than just the first segment. When log injection is enabled, this flaw allows an attacker to perform a crafted multi-segment writev call, leading to the potential to read and overwrite memory outside of the intended bounds. This issue has been addressed in version 0.9.0.

Affected Version(s)

opentelemetry-ebpf-instrumentation >= 0.7.0, < 0.9.0

References

https://github.com/open-telemetry/opentelemetry-ebpf-inst...
x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-ebpf-inst...
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.