Is CVE-2026-48496 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48496 being exploited in the wild.

How severe is CVE-2026-48496?

Medium severity, with a CVSS score of 6.2, published 11 September 2026.

Which products and versions are affected?

go.opentelemetry.io/ebpf-profiler (Go) >= 0.0.202527, = 0.0.202527, < 0.0.202622.

Is there a fix for CVE-2026-48496?

Yes. go.opentelemetry.io/ebpf-profiler (Go): upgrade to 0.0.202622 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48496 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-48496?

Check whether you run go.opentelemetry.io/ebpf-profiler (Go) or Opentelemetry Ebpf-Profiler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48496: OpenTelemetry ebpf-profiler denial of service in processPIDEvents

Q: Is there a fix for CVE-2026-48496?

Yes. go.opentelemetry.io/ebpf-profiler (Go): upgrade to 0.0.202622 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48496 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-48496?

Check whether you run go.opentelemetry.io/ebpf-profiler (Go) or Opentelemetry Ebpf-Profiler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48496 · Severity: medium · CVSS 6.2 · Published 2026-09-11

A vulnerability in the OpenTelemetry eBPF profiler allows an unprivileged user to disable the profiling agent. By running a specifically crafted workload, an attacker can cause the profiler to stop analyzing new files, effectively shutting down performance monitoring and observability for the affected system. This results in a loss of visibility into system operations but does not risk data theft.

Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-48496 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48496 being exploited in the wild.
How severe is CVE-2026-48496?: Medium severity, with a CVSS score of 6.2, published 11 September 2026.
Which products and versions are affected?: go.opentelemetry.io/ebpf-profiler (Go) >= 0.0.202527, < 0.0.202622, SEMVER:introduced=0.0.202527,fixed=0.0.202622; Opentelemetry Ebpf-Profiler >= 0.0.202527, < 0.0.202622.
Is there a fix for CVE-2026-48496?: Yes. go.opentelemetry.io/ebpf-profiler (Go): upgrade to 0.0.202622 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48496 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-48496?: Check whether you run go.opentelemetry.io/ebpf-profiler (Go) or Opentelemetry Ebpf-Profiler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/ebpf-profiler (Go): upgrade to 0.0.202622 or later
```
go get go.opentelemetry.io/ebpf-profiler@v0.0.202622
```

Technical details

A denial of service vulnerability exists in the `processPIDEvents` goroutine of the OpenTelemetry eBPF profiler. An unprivileged local process can trigger a condition that causes the goroutine to block indefinitely during an `openat2` system call while attempting to analyze ELF files. This prevents the profiler from processing any subsequent PID events, halting its functionality. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and has been resolved in version 0.0.202622 by ensuring the syscall does not block indefinitely.

Affected products

OpenTelemetry go.opentelemetry.io/ebpf-profiler >= 0.0.202527, < 0.0.202622

Identifiers

CVE-2026-48496
GHSA-f2r5-5m7w-p5cx
GO-2026-5343

Timeline

2026-06-03: disclosed: Initial report/publication by maintainers
2026-06-23: advisory: GitHub Advisory published
2026-06-23: patched: Fix released in version 0.0.202622

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.