# CVE-2026-45676: OpenTelemetry eBPF Instrumentation DoS via malformed ELF parsing

Source: https://junglewise.ai/threats/cve-2026-45676-opentelemetry-ebpf-instrumentation-dos-via-malformed-elf-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-45676 · Severity: medium · CVSS 5.5 · Published 2026-06-02

OpenTelemetry eBPF Instrumentation is a tool used to monitor and collect performance data from running applications. A security vulnerability in its file-parsing component allows a local user to crash the monitoring agent by running a specially crafted, malformed program. This results in a denial-of-service, causing a loss of visibility and observability data for all other applications on the affected system.

Technologies: [go.opentelemetry.io/obi (Go)](https://junglewise.ai/threats/technologies/go-opentelemetry-io-obi), [Opentelemetry Ebpf Instrumentation](https://junglewise.ai/threats/technologies/ebpf-instrumentation). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-45676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45676 being exploited in the wild.

**How severe is CVE-2026-45676?** Medium severity, with a CVSS score of 5.5, published 2 June 2026.

**Which products and versions are affected?** go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation < 0.9.0, Prior to 0.9.0.

**Is there a fix for CVE-2026-45676?** Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45676 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-45676?** Check whether you run go.opentelemetry.io/obi (Go) or Opentelemetry Ebpf Instrumentation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later

  ```sh
  go get go.opentelemetry.io/obi@v0.9.0
  ```


## Technical details

The OpenTelemetry eBPF Instrumentation (OBI) agent's custom ELF parser (fastelf) fails to validate section offsets, counts, and string offsets when inspecting local executables. Specifically, the 'matchExeSymbols' and 'NewElfContextFromData' functions trust metadata from the ELF header, such as Shoff and Shnum, without verifying they fall within the actual data bounds. An attacker with local execution privileges can provide a malformed ELF binary that triggers an out-of-bounds slice or a nil pointer dereference in 'GetCStringUnsafe' or 'ReadStruct'. This causes the agent to panic and terminate during process language detection. The issue is addressed in version 0.9.0 by adding overflow, bounds, and type checks.

## Affected products

- OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) Prior to 0.9.0

## Identifiers

- CVE-2026-45676
- GHSA-wp73-mwgf-4jq9
- GO-2026-5714

## Timeline

- 2026-05-11: patched: Version 0.9.0 released
- 2026-05-12: advisory: GitHub Security Advisory GHSA-wp73-mwgf-4jq9 published
- 2026-06-02: disclosed: CVE-2026-45676 published to NVD

## References

- [https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0)
- [https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-wp73-mwgf-4jq9](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-wp73-mwgf-4jq9)

## Related threats

- [OpenTelemetry eBPF Instrumentation integer overflow in Memcached parser](https://junglewise.ai/threats/cve-2026-45686-opentelemetry-ebpf-instrumentation-integer-overflow-in-memcached)
- [OpenTelemetry eBPF Instrumentation denial of service in MongoDB parser](https://junglewise.ai/threats/cve-2026-45685-opentelemetry-ebpf-instrumentation-denial-of-service-in-mongodb)
- [OpenTelemetry eBPF Instrumentation buffer over-read in log enricher](https://junglewise.ai/threats/cve-2026-45684-opentelemetry-ebpf-instrumentation-buffer-over-read-in-log)
- [OpenTelemetry OBI kernel memory disclosure in Java TLS ioctl probe](https://junglewise.ai/threats/cve-2026-45683-opentelemetry-obi-kernel-memory-disclosure-in-java-tls-ioctl)
- [OpenTelemetry eBPF Instrumentation memory leak in Java TLS tracking](https://junglewise.ai/threats/cve-2026-45682-opentelemetry-ebpf-instrumentation-memory-leak-in-java-tls)