Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

go.opentelemetry.io/ebpf-profiler

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.2GoPublished

    opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

    CVE-2026-48496 · GHSA-f2r5-5m7w-p5cx

    Affected
    • Go go.opentelemetry.io/ebpf-profiler >= 0.0.202527, < 0.0.202622
    Fixed in
    0.0.202622· Vendor fix available
    Issue
    An unprivileged process can easily trigger the processPIDEvents goroutine to be blocked indefinitely, preventing the goroutine from analyzing any new ELF file. The goroutine stays blocked in the openat2 syscall forever and the profiler can no longer work properly, it is a denial of service. Impact The impact is limited to denial-of-service on the ebpf-profiler agent: - There has to be a malicious workload albeit unprivileged. - No exfiltration of data. No loss of data. Fix Fixed in https://github.com/open-telemetry/opentelemetry-ebpf-profiler/commit/234b685cab31c2cb2f79e966caeab168bcc489e4. Fix is part of v.0.0.202622.

    Recommended action: Upgrade to 0.0.202622 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →