High severity · published Jun 2, 2026
CVE-2026-45680
OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metrics exporter to spend excessive CPU time in a tight loop every collection interval. This issue has been patched in version 0.9.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
opentelemetry-ebpf-instrumentation · open-telemetry
< 0.9.0 · source: vendor
EI
Ebpf Instrumentation · Opentelemetry
before 0.9.0 · source: NVD
Affected product
OP
opentelemetry-ebpf-instrumentation
open-telemetry
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45680
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45680
Product
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0
Exploit
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-89c6-vpcj-7vj4
More from opentelemetry-ebpf-instrumentation
8.4
CVE-2026-41433
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
7.5
CVE-2026-45686
OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
7.5
CVE-2026-45685
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
7.5
CVE-2026-45678
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
6.5
CVE-2026-45679
OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages