Executive brief
A vulnerability in the OpenTelemetry eBPF profiler allows an unprivileged user to disable the profiling agent. By running a specifically crafted workload, an attacker can cause the profiler to stop analyzing new files, effectively shutting down performance monitoring and observability for the affected system. This results in a loss of visibility into system operations but does not risk data theft.
Technical details
A denial of service vulnerability exists in the `processPIDEvents` goroutine of the OpenTelemetry eBPF profiler. An unprivileged local process can trigger a condition that causes the goroutine to block indefinitely during an `openat2` system call while attempting to analyze ELF files. This prevents the profiler from processing any subsequent PID events, halting its functionality. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and has been resolved in version 0.0.202622 by ensuring the syscall does not block indefinitely.
Affected products
- OpenTelemetry go.opentelemetry.io/ebpf-profiler >= 0.0.202527, < 0.0.202622
Timeline
- 2026-06-03: disclosed: Initial report/publication by maintainers
- 2026-06-23: advisory: GitHub Advisory published
- 2026-06-23: patched: Fix released in version 0.0.202622