https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-45686.htmlhttps://patchthecve.com/cve/CVE-2026-45686.htmlWed, 22 Jul 2026 19:10:00 +0000HIGH 7.5: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcachehttps://patchthecve.com/cve/CVE-2026-45685.htmlhttps://patchthecve.com/cve/CVE-2026-45685.htmlWed, 22 Jul 2026 19:10:00 +0000HIGH 7.5: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry ahttps://patchthecve.com/cve/CVE-2026-45684.htmlhttps://patchthecve.com/cve/CVE-2026-45684.htmlWed, 22 Jul 2026 19:10:00 +0000MEDIUM 4.9: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injectihttps://patchthecve.com/cve/CVE-2026-45683.htmlhttps://patchthecve.com/cve/CVE-2026-45683.htmlWed, 22 Jul 2026 19:10:00 +0000LOW 3.8: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kerhttps://patchthecve.com/cve/CVE-2026-45682.htmlhttps://patchthecve.com/cve/CVE-2026-45682.htmlWed, 22 Jul 2026 19:10:00 +0000MEDIUM 5.1: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the custom CappedConcurrentHashMap introduced for Java TLS state tracking never removes keys from its insertion-order queue when entries are deleted. In long-running instrumehttps://patchthecve.com/cve/CVE-2026-45681.htmlhttps://patchthecve.com/cve/CVE-2026-45681.htmlWed, 22 Jul 2026 19:10:00 +0000MEDIUM 5.9: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can readhttps://patchthecve.com/cve/CVE-2026-45680.htmlhttps://patchthecve.com/cve/CVE-2026-45680.htmlWed, 22 Jul 2026 19:10:00 +0000MEDIUM 5.9: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metricshttps://patchthecve.com/cve/CVE-2026-45679.htmlhttps://patchthecve.com/cve/CVE-2026-45679.htmlWed, 22 Jul 2026 19:10:00 +0000MEDIUM 6.5: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokhttps://patchthecve.com/cve/CVE-2026-45678.htmlhttps://patchthecve.com/cve/CVE-2026-45678.htmlWed, 22 Jul 2026 19:10:00 +0000HIGH 7.5: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the ehttps://patchthecve.com/cve/CVE-2026-45676.htmlhttps://patchthecve.com/cve/CVE-2026-45676.htmlWed, 22 Jul 2026 19:10:00 +0000MEDIUM 5.5: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can make OBI dereference invalid section pointer