CVE-2026-45682
OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
MEDIUM 5.5EPSS 0.2%
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running instrumented JVMs, repeated connection churn can therefore grow the queue without bound and exhaust heap memory. This issue has been patched in version 0.9.0.
- Affected
- open-telemetry · opentelemetry-ebpf-instrumentation
- CVSS v3.1 NVD
- 5.5 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS v3.1 GITHUB
- 5.1 MEDIUM
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 0.17% chance of exploitation in the next 30 days, 5th percentile
- Published
- 2026-06-02
Proof-of-concept exploits (1)
Security advisories
- open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-962q-hwm5-52x5
- open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0