# CVE-2026-45680: OpenTelemetry eBPF Instrumentation CPU exhaustion via excessive iteration

Source: https://junglewise.ai/threats/cve-2026-45680-opentelemetry-ebpf-instrumentation-cpu-exhaustion-via-excessive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-45680 · Severity: medium · CVSS 5.9 · Published 2026-06-02

OpenTelemetry eBPF Instrumentation is a tool used to monitor and collect performance data from running applications. A flaw in how it processes internal metrics allows an attacker to indirectly cause the monitoring agent to consume excessive CPU resources by generating a high volume of network traffic. This can lead to a denial-of-service condition where the monitoring tool becomes unresponsive or impacts the performance of the host system it is supposed to be observing.

Technologies: [go.opentelemetry.io/obi (Go)](https://junglewise.ai/threats/technologies/go-opentelemetry-io-obi), [Opentelemetry Ebpf Instrumentation](https://junglewise.ai/threats/technologies/ebpf-instrumentation), [Opentelemetry Otelhttp](https://junglewise.ai/threats/technologies/otelhttp). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-45680 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45680 being exploited in the wild.

**How severe is CVE-2026-45680?** Medium severity, with a CVSS score of 5.9, published 2 June 2026.

**Which products and versions are affected?** go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation Prior to 0.9.0.

**Is there a fix for CVE-2026-45680?** Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45680 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45680?** Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation or Opentelemetry Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later

  ```sh
  go get go.opentelemetry.io/obi@v0.9.0
  ```


## Technical details

OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0 contains an excessive iteration vulnerability (CWE-834) within its internal metrics replay logic. Specifically, in `pkg/export/prom/prom_bpf.go`, the metrics exporter replays BPF probe hits into histogram observations by looping once for every recorded run count. Because the `deltaCount` (the difference between current and previous run counts) is not capped, a high-frequency workload can cause this loop to execute an extremely large number of times during each collection interval. An attacker can exploit this by driving high traffic volumes through instrumented services, causing the privileged OBI agent to enter a tight loop and exhaust CPU resources. This issue is patched in version 0.9.0.

## Affected products

- OpenTelemetry opentelemetry-ebpf-instrumentation (OBI) Prior to 0.9.0

## Identifiers

- CVE-2026-45680
- GHSA-89c6-vpcj-7vj4
- GO-2026-5248

## Timeline

- 2026-05-11: patched: Version 0.9.0 released
- 2026-05-12: advisory: GitHub Security Advisory GHSA-89c6-vpcj-7vj4 published
- 2026-06-02: disclosed: CVE-2026-45680 published to NVD

## References

- [https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0)
- [https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-89c6-vpcj-7vj4](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-89c6-vpcj-7vj4)

## Related threats

- [OpenTelemetry eBPF Instrumentation integer overflow in Memcached parser](https://junglewise.ai/threats/cve-2026-45686-opentelemetry-ebpf-instrumentation-integer-overflow-in-memcached)
- [OpenTelemetry eBPF Instrumentation denial of service in MongoDB parser](https://junglewise.ai/threats/cve-2026-45685-opentelemetry-ebpf-instrumentation-denial-of-service-in-mongodb)
- [OpenTelemetry eBPF Instrumentation buffer over-read in log enricher](https://junglewise.ai/threats/cve-2026-45684-opentelemetry-ebpf-instrumentation-buffer-over-read-in-log)
- [OpenTelemetry OBI kernel memory disclosure in Java TLS ioctl probe](https://junglewise.ai/threats/cve-2026-45683-opentelemetry-obi-kernel-memory-disclosure-in-java-tls-ioctl)
- [OpenTelemetry eBPF Instrumentation memory leak in Java TLS tracking](https://junglewise.ai/threats/cve-2026-45682-opentelemetry-ebpf-instrumentation-memory-leak-in-java-tls)