OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0.
References
| Link | Resource |
|---|---|
| https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 | Product Release Notes |
| https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-vvmg-8mjr-g6q3 | Exploit Vendor Advisory |
| https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-vvmg-8mjr-g6q3 | Exploit Vendor Advisory |
Configurations
History
03 Jun 2026, 16:52
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:* | |
| References | () https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 - Product, Release Notes | |
| References | () https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-vvmg-8mjr-g6q3 - Exploit, Vendor Advisory | |
| First Time |
Opentelemetry ebpf Instrumentation
Opentelemetry |
02 Jun 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-vvmg-8mjr-g6q3 - |
02 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-02 16:16
Updated : 2026-06-03 16:52
NVD link : CVE-2026-45684
Mitre link : CVE-2026-45684
CVE.ORG link : CVE-2026-45684
JSON object : View
Products Affected
opentelemetry
- ebpf_instrumentation