Executive brief
OpenTelemetry eBPF Instrumentation is a tool used to monitor application performance and security. A flaw in how it tracks Java encrypted (TLS) connections causes it to leak memory every time a connection is opened and closed. Over time, this can lead to system instability, significant performance slowdowns, or complete application crashes due to memory exhaustion.
Technical details
A memory leak exists in the custom CappedConcurrentHashMap implementation used for Java TLS state tracking in OpenTelemetry eBPF Instrumentation (OBI). While the map correctly limits its size during 'put' operations, the 'remove' method fails to remove keys from the internal ConcurrentLinkedQueue used for tracking insertion order. In environments with high connection churn, this queue grows indefinitely even if the active map size remains small. An attacker or high-traffic workload can trigger repeated TLS handshakes to exhaust the JVM heap, leading to OutOfMemoryError (OOM) and denial of service. This issue is addressed in version 0.9.0 by replacing the leaky map with a ring-buffer-backed implementation.
Affected products
- OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) Prior to 0.9.0
Timeline
- 2026-05-11: patched: Version 0.9.0 released
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-02: disclosed: CVE published to NVD