PT-2026-41789 · Unknown · @Opentelemetry/Instrumentation

Mralias · CVE-2026-45684 · Published 2026-05-18 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions 0.7.0 through 0.8.x

Description The log enricher mishandles writev buffers by reading only the first iovec entry while using the total iov iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can cause the software to read and overwrite memory beyond the first segment. This occurs because the fill iov() function resolves only one struct iovec, but the write() function uses the total byte count across all segments. This memory safety flaw can lead to the corruption of adjacent application buffers, memory leakage into log events, or process instability.

Recommendations Update to version 0.9.0. As a temporary workaround, disable the log injection feature to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Buffer Over-read

Weakness Enumeration

CWE-787

CWE-126

Related Identifiers

CVE-2026-45684

GHSA-VVMG-8MJR-G6Q3

GO-2026-5677

Affected Products

@Opentelemetry/Instrumentation

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45684.json · Exploit
• 🔥 https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-vvmg-8mjr-g6q3 · Exploit
• https://osv.dev/vulnerability/GHSA-vvmg-8mjr-g6q3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45684 · Security Note
• https://osv.dev/vulnerability/GO-2026-5677 · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 · Note
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation · Note