PT-2026-41787 · Opentelemetry · @Opentelemetry/Instrumentation

Mralias · Published 2026-05-18 · Updated 2026-07-09 · CVE-2026-45682

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions prior to 0.9.0

Description A memory leak exists in the custom CappedConcurrentHashMap used for Java TLS state tracking. The remove() function deletes entries from the map but fails to remove the corresponding keys from the insertion-order queue. In long-running instrumented JVMs with frequent connection churn, this queue grows without bound, potentially leading to long garbage collection pauses or heap memory exhaustion resulting in an OutOfMemoryError.

Recommendations Update to version 0.9.0.

Exploit

Fix

Memory Leak

Allocation of Resources Without Limits

Weakness Enumeration

CWE-401

CWE-770

Related Identifiers

CVE-2026-45682

GHSA-962Q-HWM5-52X5

GO-2026-5275

OPENSUSE-SU-2026:11053-1

OPENSUSE-SU-2026:21251-1

SUSE-SU-2026:2824-1

Affected Products

@Opentelemetry/Instrumentation

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45682.json · Exploit
• 🔥 https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-962q-hwm5-52x5 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2026:2824-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11053-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21251-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-962q-hwm5-52x5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45682 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45682 · Security Note
• https://osv.dev/vulnerability/GO-2026-5275 · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 · Note
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation · Note
• https://bugzilla.suse.com/1266654 · Note
• https://bugzilla.suse.com/1266196 · Note
• https://suse.com/security/cve/CVE-2026-42502 · Note
• https://bugzilla.suse.com/1267481 · Note