Is CVE-2026-45680 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45680 being exploited in the wild.

How severe is CVE-2026-45680?

Medium severity, with a CVSS score of 5.9, published 2 June 2026.

Which products and versions are affected?

go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation Prior to 0.9.0.

Is there a fix for CVE-2026-45680?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45680 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45680?

Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation or Opentelemetry Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45680: OpenTelemetry eBPF Instrumentation CPU exhaustion via excessive iteration

Q: Is there a fix for CVE-2026-45680?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45680 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45680?

Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation or Opentelemetry Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45680 · Severity: medium · CVSS 5.9 · Published 2026-06-02

OpenTelemetry eBPF Instrumentation is a tool used to monitor and collect performance data from running applications. A flaw in how it processes internal metrics allows an attacker to indirectly cause the monitoring agent to consume excessive CPU resources by generating a high volume of network traffic. This can lead to a denial-of-service condition where the monitoring tool becomes unresponsive or impacts the performance of the host system it is supposed to be observing.

Technologies: go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation, Opentelemetry Otelhttp. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-45680 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45680 being exploited in the wild.
How severe is CVE-2026-45680?: Medium severity, with a CVSS score of 5.9, published 2 June 2026.
Which products and versions are affected?: go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation Prior to 0.9.0.
Is there a fix for CVE-2026-45680?: Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45680 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45680?: Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation or Opentelemetry Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later
```
go get go.opentelemetry.io/obi@v0.9.0
```

Technical details

OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0 contains an excessive iteration vulnerability (CWE-834) within its internal metrics replay logic. Specifically, in `pkg/export/prom/prom_bpf.go`, the metrics exporter replays BPF probe hits into histogram observations by looping once for every recorded run count. Because the `deltaCount` (the difference between current and previous run counts) is not capped, a high-frequency workload can cause this loop to execute an extremely large number of times during each collection interval. An attacker can exploit this by driving high traffic volumes through instrumented services, causing the privileged OBI agent to enter a tight loop and exhaust CPU resources. This issue is patched in version 0.9.0.

Affected products

OpenTelemetry opentelemetry-ebpf-instrumentation (OBI) Prior to 0.9.0

Identifiers

CVE-2026-45680
GHSA-89c6-vpcj-7vj4
GO-2026-5248

Timeline

2026-05-11: patched: Version 0.9.0 released
2026-05-12: advisory: GitHub Security Advisory GHSA-89c6-vpcj-7vj4 published
2026-06-02: disclosed: CVE-2026-45680 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.