Is CVE-2026-45678 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45678 being exploited in the wild.

How severe is CVE-2026-45678?

High severity, with a CVSS score of 7.5, published 2 June 2026.

Which products and versions are affected?

go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry eBPF Instrumentation < 0.9.0; Opentelemetry Go.Opentelemetry.Io/Contrib/Instrumentation/Net/Http/Otelhttp < 0.9.0.

Is there a fix for CVE-2026-45678?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45678 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45678?

Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry eBPF Instrumentation or Opentelemetry Go.Opentelemetry.Io/Contrib/Instrumentation/Net/Http/Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45678: OpenTelemetry OBI denial of service in Postgres protocol parser

Q: Is there a fix for CVE-2026-45678?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45678 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45678?

Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry eBPF Instrumentation or Opentelemetry Go.Opentelemetry.Io/Contrib/Instrumentation/Net/Http/Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45678 · Severity: high · CVSS 7.5 · Published 2026-06-02

OpenTelemetry eBPF Instrumentation is a tool used to monitor application performance and database traffic without modifying application code. A vulnerability in its PostgreSQL protocol parser allows a remote attacker to crash the monitoring agent by sending specially crafted database messages. This results in a denial of service for the telemetry system, causing a loss of visibility into the monitored environment.

Technologies: go.opentelemetry.io/obi (Go), Opentelemetry eBPF Instrumentation. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-45678 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45678 being exploited in the wild.
How severe is CVE-2026-45678?: High severity, with a CVSS score of 7.5, published 2 June 2026.
Which products and versions are affected?: go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry eBPF Instrumentation < 0.9.0; Opentelemetry Go.Opentelemetry.Io/Contrib/Instrumentation/Net/Http/Otelhttp < 0.9.0.
Is there a fix for CVE-2026-45678?: Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45678 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45678?: Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry eBPF Instrumentation or Opentelemetry Go.Opentelemetry.Io/Contrib/Instrumentation/Net/Http/Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later
```
go get go.opentelemetry.io/obi@v0.9.0
```

Technical details

A vulnerability exists in the Postgres protocol parser within OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0. The parser in 'pkg/ebpf/common/sql_detect_postgres.go' incorrectly assumes that BIND message payloads contain a valid NUL-terminated portal name. When processing a crafted empty or unterminated payload, the code attempts to slice the message buffer beyond its actual length after calling 'unix.ByteSliceToString'. This results in a Go runtime panic (index out of range). An unauthenticated remote attacker sending malformed Postgres traffic to a monitored service can crash the OBI agent, terminating telemetry collection. The issue is fixed in version 0.9.0.

Affected products

OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) < 0.9.0

Identifiers

CVE-2026-45678
GHSA-pgvv-q3wf-mm9m
GO-2026-5539

Timeline

2026-05-11: patched: Version 0.9.0 released
2026-05-12: advisory: GitHub Security Advisory published
2026-06-02: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.