High severity · published Jun 2, 2026
CVE-2026-45686
OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as set, add, replace, append, prepend, or cas, OBI accepts extremely large <bytes> values and adds the payload delimiter length without checking for overflow. A crafted request with <bytes> set to math.MaxInt or math.MaxInt-1 causes the computed payload length to wrap negative and triggers a runtime panic in LargeBufferReader.Peek. This issue has been patched in version 0.9.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
opentelemetry-ebpf-instrumentation · open-telemetry
>= 0.7.0, < 0.9.0 · source: vendor
EI
Ebpf Instrumentation · Opentelemetry
0.7.0 before 0.9.0 · source: NVD
Affected product
OP
opentelemetry-ebpf-instrumentation
open-telemetry
More from opentelemetry-ebpf-instrumentation
8.4
CVE-2026-41433
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
7.5
CVE-2026-45685
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
7.5
CVE-2026-45680
OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
7.5
CVE-2026-45678
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
6.5
CVE-2026-45679
OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages