CVE-2026-45686: OpenTelemetry eBPF Instrumentation DoS Flaw

CVE-2026-45686 Overview

CVE-2026-45686 is an integer overflow vulnerability in OpenTelemetry eBPF Instrumentation (OBI), a project that delivers eBPF-based instrumentation conforming to the OpenTelemetry standard. The flaw exists in the memcached text protocol parser and affects versions 0.7.0 through 0.8.x. A remote, unauthenticated attacker can submit a crafted memcached storage command containing an oversized <bytes> value. The parser adds the payload delimiter length without bounds checks, causing the computed length to wrap and triggering a runtime panic in LargeBufferReader.Peek. The OBI process crashes, producing a denial of service condition. The issue is fixed in version 0.9.0.

Critical Impact

Remote attackers can crash the OBI instrumentation process without authentication, disrupting observability pipelines that depend on it.

Affected Products

• OpenTelemetry eBPF Instrumentation (OBI) version 0.7.0
• OpenTelemetry eBPF Instrumentation (OBI) versions 0.7.x and 0.8.x prior to 0.9.0
• Deployments instrumenting memcached traffic via the OBI text protocol parser

Discovery Timeline

• 2026-06-02 - CVE-2026-45686 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-45686

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in the memcached text protocol parser embedded in OBI. When OBI inspects memcached storage commands such as set, add, replace, append, prepend, or cas, the parser reads the <bytes> field declaring payload size. The parser then adds the length of the terminating delimiter to this value to compute the total bytes to peek from the network buffer.

No overflow check exists on this addition. When <bytes> is set to math.MaxInt or math.MaxInt-1, the addition wraps to a negative value. The negative length is passed into LargeBufferReader.Peek, which raises a runtime panic. The panic terminates the OBI process, disrupting telemetry collection.

Root Cause

The root cause is missing arithmetic bounds validation on attacker-controlled input. The memcached parser trusts the <bytes> field from the wire and performs unchecked addition with the delimiter constant. Go's integer arithmetic silently wraps on overflow, and downstream consumers assume a non-negative length, leading to the panic.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a single crafted memcached storage command containing a <bytes> value at or near math.MaxInt to a host whose memcached traffic is being instrumented by a vulnerable OBI process. Parsing the command triggers the overflow and crashes OBI.

The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-43g7-cwr8-q3jh.

Detection Methods for CVE-2026-45686

Indicators of Compromise

• Unexpected OBI process termination with Go runtime panic stack traces referencing LargeBufferReader.Peek.
• Memcached traffic containing storage commands (set, add, replace, append, prepend, cas) with <bytes> values approaching math.MaxInt.
• Gaps in OpenTelemetry traces or metrics correlated with OBI restarts.

Detection Strategies

• Inspect memcached traffic for storage commands declaring abnormally large <bytes> payload sizes that exceed any realistic application value.
• Monitor OBI container or service restart counts and correlate with crash logs containing integer overflow or panic indicators.
• Alert on repeated panics in OBI binaries running versions 0.7.0 through 0.8.x.

Monitoring Recommendations

• Forward OBI stderr and crash logs to a central logging system and alert on Go panic signatures.
• Track the version of OBI deployed across the fleet to identify hosts still on vulnerable releases.
• Baseline memcached request sizes per environment and flag outliers consistent with overflow probing.

How to Mitigate CVE-2026-45686

Immediate Actions Required

• Upgrade all OBI deployments to version 0.9.0 or later as published in the OBI v0.9.0 release notes.
• Inventory hosts running OBI versions 0.7.0 through 0.8.x and prioritize internet-adjacent or shared-tenant systems.
• Restart OBI on a supervisor that automatically recovers the process to limit downtime if exploitation is attempted before patching completes.

Patch Information

The issue is patched in OpenTelemetry eBPF Instrumentation version 0.9.0. The fix adds overflow checks to the memcached text protocol parser so that oversized <bytes> values are rejected before being passed to LargeBufferReader.Peek. Refer to the GitHub Security Advisory GHSA-43g7-cwr8-q3jh for full advisory details.

Workarounds

• Restrict network reachability of memcached endpoints instrumented by OBI to trusted clients via firewall rules or service mesh policies.
• Disable OBI memcached instrumentation if the protocol is not required in the environment until the upgrade can be completed.
• Place a protocol-aware proxy in front of memcached that rejects storage commands with implausible <bytes> values.