CVE-2026-45683: OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

May 18, 2026 (updated June 9, 2026)

The Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry.

References

github.com/advisories/GHSA-fjq3-ffvr-vm46
github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0
github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46
nvd.nist.gov/vuln/detail/CVE-2026-45683

Code Behaviors & Features

Detect and mitigate CVE-2026-45683 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →