Title: OpenTelemetry eBPF Instrumentation de open-telemetry, Description: OpenTelemetry eBPF Instrumentation proporciona instrumentación eBPF basada en el estándar OpenTelemetry. Desde la versión 0.7.0 hasta antes de la versión 0.9.0, un desbordamiento de entero accesible remotamente en el analizador del protocolo de texto de memcached de OBI puede bloquear el proceso de OBI y causar denegación de servicio. Al analizar comandos de almacenamiento de memcached como set, add, replace, append, prepend o cas, OBI acepta valores <bytes> extremadamente grandes y añade la longitud del delimitador de la carga útil sin comprobar si hay desbordamiento. Una solicitud manipulada con <bytes> establecido en math.MaxInt o math.MaxInt-1 hace que la longitud de la carga útil calculada se envuelva a negativo y desencadena un pánico en tiempo de ejecución en LargeBufferReader.Peek. Este problema ha sido parcheado en la versión 0.9.0.

{"timestamp":"2026-06-03T13:47:57.502090Z","id":"CVE-2026-45686","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"open-telemetry","product":"opentelemetry-ebpf-instrumentation","versions":[{"version":">= 0.7.0, < 0.9.0","status":"affected"}]}]

OR
          *cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:* versions from (including) 0.7.0 up to (excluding) 0.9.0

CISA-ADP: https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-43g7-cwr8-q3jh Types: Exploit, Vendor Advisory

GitHub, Inc.: https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 Types: Product, Release Notes

GitHub, Inc.: https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-43g7-cwr8-q3jh Types: Exploit, Vendor Advisory

https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-43g7-cwr8-q3jh

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as set, add, replace, append, prepend, or cas, OBI accepts extremely large <bytes> values and adds the payload delimiter length without checking for overflow. A crafted request with <bytes> set to math.MaxInt or math.MaxInt-1 causes the computed payload length to wrap negative and triggers a runtime panic in LargeBufferReader.Peek. This issue has been patched in version 0.9.0.

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-190

https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0

https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-43g7-cwr8-q3jh