Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. go.opentelemetry.io/obi
  4. ›
  5. CVE-2026-45685

CVE-2026-45685: OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

May 18, 2026 (updated June 9, 2026)

Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads before the input is fully validated, so a single crafted message can terminate telemetry collection for the affected process or node.

References

  • github.com/advisories/GHSA-j8p6-96vp-f3r9
  • github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0
  • github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-j8p6-96vp-f3r9
  • nvd.nist.gov/vuln/detail/CVE-2026-45685

Code Behaviors & Features

Detect and mitigate CVE-2026-45685 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 0.9.0

Fixed versions

  • 0.9.0

Solution

Upgrade to version 0.9.0 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-20: Improper Input Validation
  • CWE-248: Uncaught Exception
  • CWE-704: Incorrect Type Conversion or Cast

Source file

go/go.opentelemetry.io/obi/CVE-2026-45685.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:17:18 +0000.