CVE-2026-45682
OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 5.1EPSS 0.2%KEV nãoPoC —Patch —
Ciclo de vida
02 jun 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running instrumented JVMs, repeated connection churn can therefore grow the queue without bound and exhaust heap memory. This issue has been patched in version 0.9.0.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
open-telemetry · opentelemetry-ebpf-instrumentation¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →