CVE-2026-45678 HIGH

CVE-2026-45678: OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

Vendor Open-Telemetry
Product opentelemetry-ebpf-instrumentation
Weakness CWE-20 · Input validation
Published June 2, 2026
Last update June 2, 2026

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0.

Key dates

02Disclosure timeline

June 2, 2026 CVE published
June 2, 2026 Record updated