CVE-2026-45686: OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
(updated )
A remotely reachable integer overflow in OBI’s memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as set, add, replace, append, prepend, or cas, OBI accepts extremely large <bytes> values and adds the payload delimiter length without checking for overflow. A crafted request with <bytes> set to math.MaxInt or math.MaxInt-1 causes the computed payload length to wrap negative and triggers a runtime panic in LargeBufferReader.Peek.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-45686 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →