CVE-2026-45686

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45686
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45686.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45686
Aliases
Downstream
Related
Published
2026-06-02T15:25:55.764Z
Modified
2026-07-09T10:14:40.886668404Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
Details

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as set, add, replace, append, prepend, or cas, OBI accepts extremely large <bytes> values and adds the payload delimiter length without checking for overflow. A crafted request with <bytes> set to math.MaxInt or math.MaxInt-1 causes the computed payload length to wrap negative and triggers a runtime panic in LargeBufferReader.Peek. This issue has been patched in version 0.9.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45686.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-190"
    ]
}
References

Affected packages

Git / github.com/open-telemetry/opentelemetry-ebpf-instrumentation

Affected ranges

Type
GIT
Repo
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation
Events
Introduced
ace60aa3949e41c4f9abcb0f0c4eaf681f5e98e3
Fixed
e92b0c2dd4d88b90d28b7b706eacbac2fabd2623
Database specific 
{
    "cpe": "cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*",
    "extracted_events": [
        {
            "introduced": "0.7.0"
        },
        {
            "fixed": "0.9.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.7.0
v0.7.1
v0.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45686.json"