Executive brief
OpenTelemetry eBPF Instrumentation is a tool used to monitor and collect performance data from running applications. A flaw in how it processes internal metrics allows an attacker to indirectly cause the monitoring agent to consume excessive CPU resources by generating a high volume of network traffic. This can lead to a denial-of-service condition where the monitoring tool becomes unresponsive or impacts the performance of the host system it is supposed to be observing.
Technical details
OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0 contains an excessive iteration vulnerability (CWE-834) within its internal metrics replay logic. Specifically, in `pkg/export/prom/prom_bpf.go`, the metrics exporter replays BPF probe hits into histogram observations by looping once for every recorded run count. Because the `deltaCount` (the difference between current and previous run counts) is not capped, a high-frequency workload can cause this loop to execute an extremely large number of times during each collection interval. An attacker can exploit this by driving high traffic volumes through instrumented services, causing the privileged OBI agent to enter a tight loop and exhaust CPU resources. This issue is patched in version 0.9.0.
Affected products
- OpenTelemetry opentelemetry-ebpf-instrumentation (OBI) Prior to 0.9.0
Timeline
- 2026-05-11: patched: Version 0.9.0 released
- 2026-05-12: advisory: GitHub Security Advisory GHSA-89c6-vpcj-7vj4 published
- 2026-06-02: disclosed: CVE-2026-45680 published to NVD