CVE-2026-45684

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45684

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45684.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45684

Aliases

Published

2026-06-02T15:25:32.538Z

Modified

2026-07-08T08:12:34.910496318Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers

Details

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45684.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-126",
        "CWE-787"
    ]
}

References

Affected packages

Git / github.com/open-telemetry/opentelemetry-ebpf-instrumentation

Affected ranges

Type

GIT

Repo

https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation

Events

Introduced

ace60aa3949e41c4f9abcb0f0c4eaf681f5e98e3

Fixed

e92b0c2dd4d88b90d28b7b706eacbac2fabd2623

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*",
    "extracted_events": [
        {
            "introduced": "0.7.0"
        },
        {
            "fixed": "0.9.0"
        }
    ]
}

Affected versions

v0.*

v0.7.0

v0.7.1

v0.8.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45684.json"