What’s Vulnerable › Vulnerabilities

CVE-2026-45680: OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-02 · updated 2026-07-22
• Weakness: CWE-400

Description

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metrics exporter to spend excessive CPU time in a tight loop every collection interval. This issue has been patched in version 0.9.0.

Affected products

• open-telemetry opentelemetry-ebpf-instrumentation: before 0.9.0 — fixed in 0.9.0

How to fix

Upgrade to a fixed version: open-telemetry opentelemetry-ebpf-instrumentation 0.9.0. Check the vendor advisory for mitigations.

References

• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-89c6-vpcj-7vj4
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-89c6-vpcj-7vj4

Get alerted when CVE-2026-45680 or the next vulnerability affects your stack