CVE-2026-45686: OpenTelemetry eBPF Instrumentation Integer Overflow DoS Vulnerability

Technical summary

The vulnerability exists in OBI's memcached text protocol parser, which processes storage commands (set, add, replace, append, prepend, cas). When parsing the <bytes> parameter of these commands, the parser fails to validate for integer overflow before adding the payload delimiter length to the specified byte count. Specifically, when <bytes> is set to math.MaxInt or math.MaxInt-1, the arithmetic operation causes an integer wraparound, resulting in a negative value. This negative payload length is subsequently passed to LargeBufferReader.Peek(), triggering a runtime panic that terminates the OBI process. The root cause is insufficient input validation on the <bytes> field during protocol parsing.

Business impact

Organizations using OpenTelemetry eBPF Instrumentation for application performance monitoring and distributed tracing will experience service disruption if exploited. The denial-of-service condition prevents collection of telemetry data, blinding observability infrastructure and potentially masking other issues in the monitored environment. Instrumentation outages can impact incident response capabilities and performance troubleshooting, though direct application functionality is not compromised since OBI operates as a separate observability component. For teams relying on continuous monitoring for compliance or SLA reporting, extended outages could affect audit trails and reporting accuracy.

Affected systems

The vulnerability affects OpenTelemetry eBPF Instrumentation (OBI) from version 0.7.0 up to and including version 0.8.x. Version 0.9.0 and later contain the fix. Any deployment running OBI in this version range is vulnerable if the instrumentation process is exposed to or receives traffic from untrusted networks or malicious actors capable of sending crafted memcached protocol messages.

Exploitability

This vulnerability is remotely exploitable without authentication or user interaction. The memcached text protocol is accessed over the network, and an attacker only needs to send a single malformed memcached command with an oversized <bytes> value to trigger the crash. No special privileges, credentials, or client-side complexity are required—a simple network request suffices. The attack surface includes any network path through which OBI receives memcached-protocol traffic, making it straightforward to exploit from a remote position.

Remediation

Upgrade OpenTelemetry eBPF Instrumentation to version 0.9.0 or later, which includes proper integer overflow protection in the memcached parser. Organizations unable to upgrade immediately should implement network-level controls to restrict access to the OBI process, limiting exposure to trusted networks or authenticated clients only. Monitor OBI process logs and crash reports for evidence of exploitation attempts.

Patch guidance

Apply the upgrade to version 0.9.0 or any subsequent release as provided by the OpenTelemetry project. Verify the installed version before and after patching. Given that this is a critical observability component, plan the upgrade during a maintenance window to avoid data collection gaps. Test the upgrade in a non-production environment first to ensure compatibility with your instrumentation configuration and downstream systems consuming OBI data. Consult the OpenTelemetry release notes and advisory for any breaking changes or migration guidance.

Detection guidance

Monitor OBI process crash events and restart patterns, particularly looking for runtime panics in LargeBufferReader.Peek or memcached protocol parser stack traces. Network-based detection is challenging due to the need to parse memcached protocol details, but anomalous connection attempts to the OBI endpoint with unusually large byte-count values in memcached commands may be suspicious. Correlate OBI process terminations with gaps in telemetry data collection. Enable detailed logging in OBI if available to capture malformed protocol messages preceding crashes. Baseline normal OBI availability and alert on unexpected restarts.

Why prioritize this

Although the CVSS score of 7.5 reflects high severity, this vulnerability should be prioritized based on your deployment topology. If OBI is accessible from untrusted networks or the internet, treat it as critical and patch immediately. If OBI is isolated to internal networks with access controls, prioritize it as high but with slightly more flexibility in scheduling. The lack of KEV status and absence of active exploitation in the wild provide a narrow window to patch before potential public disclosure spurs attacks. The operational impact of instrumentation outages—loss of observability—compounds the urgency even if direct revenue-facing services are not affected.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the ease of remote exploitation (network-accessible, low complexity, no authentication required) combined with a high-impact denial-of-service outcome. The vector confirms zero requirements for user interaction or privilege escalation. Confidentiality and integrity are not affected—only availability is compromised. The score does not account for the indirect business risk posed by loss of observability, which may warrant elevated prioritization depending on your environment's reliance on continuous monitoring.

Frequently asked questions