What’s Vulnerable › Vulnerabilities

CVE-2026-45676: OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-02 · updated 2026-07-22
• Weakness: CWE-20

Description

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can make OBI dereference invalid section pointers or slice past string tables, causing the agent to panic while determining the process language. This issue has been patched in version 0.9.0.

Affected products

• open-telemetry opentelemetry-ebpf-instrumentation: before 0.9.0 — fixed in 0.9.0

How to fix

Upgrade to a fixed version: open-telemetry opentelemetry-ebpf-instrumentation 0.9.0. Check the vendor advisory for mitigations.

References

• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-wp73-mwgf-4jq9
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-wp73-mwgf-4jq9

Get alerted when CVE-2026-45676 or the next vulnerability affects your stack