# CVE-2026-45678: OpenTelemetry OBI denial of service in Postgres protocol parser

Source: https://junglewise.ai/threats/cve-2026-45678-opentelemetry-obi-denial-of-service-in-postgres-protocol-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-45678 · Severity: high · CVSS 7.5 · Published 2026-06-02

OpenTelemetry eBPF Instrumentation is a tool used to monitor application performance and database traffic without modifying application code. A vulnerability in its PostgreSQL protocol parser allows a remote attacker to crash the monitoring agent by sending specially crafted database messages. This results in a denial of service for the telemetry system, causing a loss of visibility into the monitored environment.

Technologies: [go.opentelemetry.io/obi (Go)](https://junglewise.ai/threats/technologies/go-opentelemetry-io-obi), [Opentelemetry eBPF Instrumentation](https://junglewise.ai/threats/technologies/ebpf-instrumentation). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-45678 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45678 being exploited in the wild.

**How severe is CVE-2026-45678?** High severity, with a CVSS score of 7.5, published 2 June 2026.

**Which products and versions are affected?** go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry eBPF Instrumentation < 0.9.0; Opentelemetry Go.Opentelemetry.Io/Contrib/Instrumentation/Net/Http/Otelhttp < 0.9.0.

**Is there a fix for CVE-2026-45678?** Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45678 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45678?** Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry eBPF Instrumentation or Opentelemetry Go.Opentelemetry.Io/Contrib/Instrumentation/Net/Http/Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later

  ```sh
  go get go.opentelemetry.io/obi@v0.9.0
  ```


## Technical details

A vulnerability exists in the Postgres protocol parser within OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0. The parser in 'pkg/ebpf/common/sql_detect_postgres.go' incorrectly assumes that BIND message payloads contain a valid NUL-terminated portal name. When processing a crafted empty or unterminated payload, the code attempts to slice the message buffer beyond its actual length after calling 'unix.ByteSliceToString'. This results in a Go runtime panic (index out of range). An unauthenticated remote attacker sending malformed Postgres traffic to a monitored service can crash the OBI agent, terminating telemetry collection. The issue is fixed in version 0.9.0.

## Affected products

- OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) < 0.9.0

## Identifiers

- CVE-2026-45678
- GHSA-pgvv-q3wf-mm9m
- GO-2026-5539

## Timeline

- 2026-05-11: patched: Version 0.9.0 released
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-02: disclosed: CVE published to NVD

## References

- [https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0)
- [https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-pgvv-q3wf-mm9m](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-pgvv-q3wf-mm9m)

## Related threats

- [OpenTelemetry eBPF Instrumentation integer overflow in Memcached parser](https://junglewise.ai/threats/cve-2026-45686-opentelemetry-ebpf-instrumentation-integer-overflow-in-memcached)
- [OpenTelemetry eBPF Instrumentation denial of service in MongoDB parser](https://junglewise.ai/threats/cve-2026-45685-opentelemetry-ebpf-instrumentation-denial-of-service-in-mongodb)
- [OpenTelemetry eBPF Instrumentation buffer over-read in log enricher](https://junglewise.ai/threats/cve-2026-45684-opentelemetry-ebpf-instrumentation-buffer-over-read-in-log)
- [OpenTelemetry OBI kernel memory disclosure in Java TLS ioctl probe](https://junglewise.ai/threats/cve-2026-45683-opentelemetry-obi-kernel-memory-disclosure-in-java-tls-ioctl)
- [OpenTelemetry eBPF Instrumentation memory leak in Java TLS tracking](https://junglewise.ai/threats/cve-2026-45682-opentelemetry-ebpf-instrumentation-memory-leak-in-java-tls)