# go.opentelemetry.io/obi (Go) vulnerabilities 11 known vulnerabilities (4 high, 6 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.0.0 (Oct 30, 2026): no advisory affects it - Newest unaffected release: v1.0.0 (Oct 30, 2026), the latest release - Releases: 24 since v0.1.0 (Oct 30, 2025) - Registry: https://pkg.go.dev/go.opentelemetry.io/obi - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-45686: v0.7.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-45685: v0.1.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-45684: v0.7.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-45683: v0.1.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-45681: v0.1.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-45680: v0.1.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-45679: v0.1.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-45678: v0.1.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-45676: v0.1.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-45682: v0.1.0 to v0.8.0 (v0.9.0 is outside it) - CVE-2026-41433: v0.4.0 to v0.7.1 (v0.8.0 is outside it) ## Advisories (11) ### [CVE-2026-45686](https://cve.now/CVE-2026-45686): OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI - Severity: High 7.5 - Published: Jun 2, 2026 - Affected: from 0.7.0, fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-45685](https://cve.now/CVE-2026-45685): OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages - Severity: High 7.5 - Published: Jun 2, 2026 - Affected: fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-45684](https://cve.now/CVE-2026-45684): OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers - Severity: Medium 4.9 - Published: Jun 2, 2026 - Affected: from 0.7.0, fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-45683](https://cve.now/CVE-2026-45683): OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure - Severity: Low 3.8 - Published: Jun 2, 2026 - Affected: fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-45681](https://cve.now/CVE-2026-45681): OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size - Severity: Medium 5.9 - Published: Jun 2, 2026 - Affected: fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-45680](https://cve.now/CVE-2026-45680): OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU - Severity: Medium 5.9 - Published: Jun 2, 2026 - Affected: fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-45679](https://cve.now/CVE-2026-45679): OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages - Severity: Medium 6.5 - Published: Jun 2, 2026 - Affected: fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-45678](https://cve.now/CVE-2026-45678): OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads - Severity: High 7.5 - Published: Jun 2, 2026 - Affected: fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-45676](https://cve.now/CVE-2026-45676): OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent - Severity: Medium 5.5 - Published: Jun 2, 2026 - Affected: fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-45682](https://cve.now/CVE-2026-45682): OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals - Severity: Medium 5.1 - Published: Jun 2, 2026 - Affected: fixed in 0.9.0. - Fixed in v0.9.0 (released May 11, 2026, 22 days before disclosure). - The latest release, v1.0.0, is not affected. ### [CVE-2026-41433](https://cve.now/CVE-2026-41433): OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR - Severity: High 8.4 - Published: Apr 24, 2026 - Affected: from 0.4.0, fixed in 0.8.0. - Fixed in v0.8.0 (released Apr 16, 2026, 8 days before disclosure). - The latest release, v1.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/go.opentelemetry.io/obi Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.