Skip to main content
cve.nowby Sazabi
← Go
GoPackage

go.opentelemetry.io/obi

11 known vulnerabilities (4 high, 6 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
v1.0.0 (Oct 30, 2026): no advisory affects it
Newest unaffected release
v1.0.0 (Oct 30, 2026), the latest release
Advisories
11 · 4 high, 6 medium, 1 low
Releases
24 since v0.1.0 (Oct 30, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 11

  • OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

    Affected: from 0.7.0, fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • CVE-2026-45684Medium 4.9

    OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers

    Affected: from 0.7.0, fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • CVE-2026-45681Medium 5.9

    OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • CVE-2026-45680Medium 5.9

    OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • CVE-2026-45679Medium 6.5

    OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • CVE-2026-45676Medium 5.5

    OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • CVE-2026-45682Medium 5.1

    OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure).

    The latest release, v1.0.0, is not affected.

  • OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

    Affected: from 0.4.0, fixed in 0.8.0.

    Fixed in v0.8.0 (released Apr 16, 2026, 8 days before disclosure).

    The latest release, v1.0.0, is not affected.