Is CVE-2026-45676 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45676 being exploited in the wild.

How severe is CVE-2026-45676?

Medium severity, with a CVSS score of 5.5, published 2 June 2026.

Which products and versions are affected?

go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation < 0.9.0, Prior to 0.9.0.

Is there a fix for CVE-2026-45676?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45676 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-45676?

Check whether you run go.opentelemetry.io/obi (Go) or Opentelemetry Ebpf Instrumentation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45676: OpenTelemetry eBPF Instrumentation DoS via malformed ELF parsing

Q: Is there a fix for CVE-2026-45676?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45676 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-45676?

Check whether you run go.opentelemetry.io/obi (Go) or Opentelemetry Ebpf Instrumentation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45676 · Severity: medium · CVSS 5.5 · Published 2026-06-02

OpenTelemetry eBPF Instrumentation is a tool used to monitor and collect performance data from running applications. A security vulnerability in its file-parsing component allows a local user to crash the monitoring agent by running a specially crafted, malformed program. This results in a denial-of-service, causing a loss of visibility and observability data for all other applications on the affected system.

Technologies: go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-45676 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45676 being exploited in the wild.
How severe is CVE-2026-45676?: Medium severity, with a CVSS score of 5.5, published 2 June 2026.
Which products and versions are affected?: go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation < 0.9.0, Prior to 0.9.0.
Is there a fix for CVE-2026-45676?: Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45676 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-45676?: Check whether you run go.opentelemetry.io/obi (Go) or Opentelemetry Ebpf Instrumentation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later
```
go get go.opentelemetry.io/obi@v0.9.0
```

Technical details

The OpenTelemetry eBPF Instrumentation (OBI) agent's custom ELF parser (fastelf) fails to validate section offsets, counts, and string offsets when inspecting local executables. Specifically, the 'matchExeSymbols' and 'NewElfContextFromData' functions trust metadata from the ELF header, such as Shoff and Shnum, without verifying they fall within the actual data bounds. An attacker with local execution privileges can provide a malformed ELF binary that triggers an out-of-bounds slice or a nil pointer dereference in 'GetCStringUnsafe' or 'ReadStruct'. This causes the agent to panic and terminate during process language detection. The issue is addressed in version 0.9.0 by adding overflow, bounds, and type checks.

Affected products

OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) Prior to 0.9.0

Identifiers

CVE-2026-45676
GHSA-wp73-mwgf-4jq9
GO-2026-5714

Timeline

2026-05-11: patched: Version 0.9.0 released
2026-05-12: advisory: GitHub Security Advisory GHSA-wp73-mwgf-4jq9 published
2026-06-02: disclosed: CVE-2026-45676 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.