CVE-2026-45678
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jun 2, 2026
CISA due date
—
The record
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | alloy | 0 | 1.17.0-1.1 |
Related vulnerabilities
- CVE-2026-10722 A vulnerability has been found in cilium ebpf up to 0.21.0. Also affects alloy
- CVE-2026-45686 OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the… Also affects alloy
- CVE-2026-45685 OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the… Also affects alloy
- CVE-2026-45682 OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the… Also affects alloy
- CVE-2026-44740 Billy is an interface filesystem abstraction for Go. Also affects alloy
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects alloy
- CVE-2026-25681 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects alloy
- CVE-2026-25680 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of… Also affects alloy