Vulnerability · Published Jun 2, 2026 · Assigned by GitHub_M
CVE-2026-45682OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
Medium 5.1
In plain English
A medium-severity memory leak in opentelemetry-ebpf-instrumentation from open-telemetry. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running instrumented JVMs, repeated connection churn can therefore grow the queue without bound and exhaust heap memory. This issue has been patched in version 0.9.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | go.opentelemetry.io/obi | 0.9.0 | GHSA-962q-hwm5-52x5 |
| Go | go.opentelemetry.io/obi | 0.9.0 | GO-2026-5275 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-telemetry | opentelemetry-ebpf-instrumentation | < 0.9.0 |
Weakness: CWE-401, CWE-770 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H