CVE-2026-45680: OpenTelemetry eBPF Instrumentation CPU Exhaustion DoS

Technical summary

The vulnerability stems from an inefficient metrics aggregation pattern in OpenTelemetry eBPF Instrumentation. The instrumentation layer replays eBPF probe observations into histogram observations by looping iteration-per-run-count. Under high cardinality or sustained load, the accumulated run-count delta between collection intervals can become substantial, causing the metrics exporter to execute a tight loop consuming disproportionate CPU resources during each metrics scrape cycle. This is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-834 (Excessive Iteration), both indicating algorithmic inefficiency. The issue has been resolved in version 0.9.0 by optimizing the replay mechanism to avoid unnecessary iterations.

Business impact

Organizations using OpenTelemetry eBPF Instrumentation for observability on production systems may experience unexpected CPU spikes coinciding with metrics collection intervals. On busy systems—particularly those handling high-throughput workloads or running instrumented containerized environments—this can trigger auto-scaling events, reduce headroom for application workloads, trigger resource alerts, or in severe cases cause noticeable latency increases. For teams relying on eBPF instrumentation for deep system visibility, this performance cliff creates a trade-off between observability coverage and resource footprint until remediation is deployed.

Affected systems

OpenTelemetry eBPF Instrumentation (opentelemetry ebpf_instrumentation) versions prior to 0.9.0 are affected. This includes all earlier minor and patch releases. Environments most at risk are those running sustained high-cardinality workloads, containerized services with dense instrumentation, or systems collecting metrics at frequent intervals. The vulnerability manifests primarily on systems with sufficiently high probe hit rates to trigger large run-count deltas.

Exploitability

Exploitation does not require authentication, network access, or user interaction; the condition is triggered by normal operational load on the host system itself. The CVSS vector (AC:H) reflects that triggering the performance impact requires specific conditions—sustained high system activity sufficient to generate large run-count deltas. This is not a remote code execution vector or a network-exploitable flaw; rather, it is an operational DoS condition that affects resource availability. Threat actors cannot directly weaponize this remotely, but the impact is real and automatic on affected systems under load.

Remediation

Upgrade OpenTelemetry eBPF Instrumentation to version 0.9.0 or later. This version includes the patch that optimizes the histogram observation replay mechanism to eliminate the tight loop. Organizations should validate the upgrade in a staging environment first to confirm compatibility with their observability pipeline and eBPF kernel support. No configuration changes or workarounds are necessary post-upgrade.

Patch guidance

Update the opentelemetry ebpf_instrumentation package to version 0.9.0 or any later release. Consult your package manager's documentation and OpenTelemetry's official release notes to confirm the upgrade path for your deployment model (binary, container image, or compiled instrumentation library). Verify kernel eBPF support and SEC capability requirements remain met after upgrade. Rollout should be prioritized for production systems currently experiencing high metric collection CPU overhead.

Detection guidance

Monitor metrics exporter CPU time and collection latency during normal operation. A spike in CPU consumption synchronized with metrics collection intervals—or a significant jump in scrape duration—may indicate the presence of this vulnerability. Examine the OpenTelemetry instrumentation version in your deployment manifests or runtime introspection tools. Check system logs and performance monitoring dashboards for correlation between probe activity spikes and CPU utilization during high-load periods. Compare actual observed behavior against baseline performance before and after patching to validate the fix.

Why prioritize this

Although rated MEDIUM (CVSS 5.9), this vulnerability should be prioritized in observability-critical environments and high-throughput systems. The impact is availability-focused and operationally immediate: CPU exhaustion on busy systems directly undermines reliability and can cascade into cascading failures if resource contention spreads. Organizations running eBPF instrumentation are typically doing so because they require deep visibility into high-performance workloads; the irony of instrumentation itself degrading performance makes this a practical headache worth addressing promptly. Prioritize systems already experiencing metrics collection overhead or running consistently high utilization workloads.

Risk score, explained

The CVSS 5.9 MEDIUM score reflects the absence of confidentiality or integrity impact (C:N, I:N) and the requirement for specific operational conditions to manifest (AC:H). However, the availability impact (A:H) is genuine and automatic once conditions are met. The score appropriately captures that this is not a remote code execution or data breach risk, but a resource exhaustion problem that, while containable and patchable, causes real operational friction.

Frequently asked questions