# CVE-2026-48496: OpenTelemetry ebpf-profiler denial of service in processPIDEvents

Source: https://junglewise.ai/threats/cve-2026-48496-opentelemetry-ebpf-profiler-denial-of-service-in-processpidevents  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-48496 · Severity: medium · CVSS 6.2 · Published 2026-09-11

A vulnerability in the OpenTelemetry eBPF profiler allows an unprivileged user to disable the profiling agent. By running a specifically crafted workload, an attacker can cause the profiler to stop analyzing new files, effectively shutting down performance monitoring and observability for the affected system. This results in a loss of visibility into system operations but does not risk data theft.

Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-48496 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48496 being exploited in the wild.

**How severe is CVE-2026-48496?** Medium severity, with a CVSS score of 6.2, published 11 September 2026.

**Which products and versions are affected?** go.opentelemetry.io/ebpf-profiler (Go) >= 0.0.202527, < 0.0.202622, SEMVER:introduced=0.0.202527,fixed=0.0.202622; Opentelemetry Ebpf-Profiler >= 0.0.202527, < 0.0.202622.

**Is there a fix for CVE-2026-48496?** Yes. go.opentelemetry.io/ebpf-profiler (Go): upgrade to 0.0.202622 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48496 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-48496?** Check whether you run go.opentelemetry.io/ebpf-profiler (Go) or Opentelemetry Ebpf-Profiler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.opentelemetry.io/ebpf-profiler (Go): upgrade to 0.0.202622 or later

  ```sh
  go get go.opentelemetry.io/ebpf-profiler@v0.0.202622
  ```


## Technical details

A denial of service vulnerability exists in the `processPIDEvents` goroutine of the OpenTelemetry eBPF profiler. An unprivileged local process can trigger a condition that causes the goroutine to block indefinitely during an `openat2` system call while attempting to analyze ELF files. This prevents the profiler from processing any subsequent PID events, halting its functionality. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and has been resolved in version 0.0.202622 by ensuring the syscall does not block indefinitely.

## Affected products

- OpenTelemetry go.opentelemetry.io/ebpf-profiler >= 0.0.202527, < 0.0.202622

## Identifiers

- CVE-2026-48496
- GHSA-f2r5-5m7w-p5cx
- GO-2026-5343

## Timeline

- 2026-06-03: disclosed: Initial report/publication by maintainers
- 2026-06-23: advisory: GitHub Advisory published
- 2026-06-23: patched: Fix released in version 0.0.202622

## References

- [https://api.github.com/users/alban](https://api.github.com/users/alban)
- [https://github.com/alban](https://github.com/alban)
- [https://api.github.com/users/alban/gists%7B/gist_id%7D](https://api.github.com/users/alban/gists%7B/gist_id%7D)
- [https://api.github.com/users/alban/repos](https://api.github.com/users/alban/repos)
- [https://avatars.githubusercontent.com/u/27575?v=4](https://avatars.githubusercontent.com/u/27575?v=4)
- [https://api.github.com/users/alban/events%7B/privacy%7D](https://api.github.com/users/alban/events%7B/privacy%7D)