CVE-2026-48496— opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
Quick assessment
Affected
open-telemetry opentelemetry-ebpf-profiler
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenTelemetry eBPF Profiler 是一个用于对多种编程语言中的应用进行性能剖析的生产级代理。从版本 0.0.202527 开始，在版本 0.0.202622 之前，非特权进程可能导致剖析器打开一个非常规映射文件（如命名管道 FIFO），从而造成无限期阻塞，进而阻止进一步的 ELF 分析，并引发拒绝服务（DoS）。版本 0.0.202622 中已包含修复补丁。目前没有已知的临时解决方案。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| open-telemetry | opentelemetry-ebpf-profiler | >= 0.0.202527, < 0.0.202622 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48496
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
Source: CVE Program / CVE List V5
Vulnerability Description
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-telemetry | opentelemetry-ebpf-profiler | >= 0.0.202527, < 0.0.202622 | - |
|
II. Public POCs for CVE-2026-48496
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48496
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-48496 (1)
Vendor Advisories for CVE-2026-48496 (1)
Vendor Pages for CVE-2026-48496 (1)
IV. Related Vulnerabilities
Same vendor: open-telemetry
-
CVE-2026-81192
OpenTelemetry.Resources.Host vulnerable to arbitrary code ex -
CVE-2026-45404
OpenTelemetry-Go: Unsynchronized baggage map can panic under -
CVE-2026-48504
OpenTelemetry Rust: Unbounded memory allocation in W3C Bagga -
CVE-2026-59892
OpenTelemetry JavaScript: Denial of service in `JaegerPropag -
CVE-2026-54712
OpenTelemetry Javaagent RMI context propagation allows resou
Same weakness: CWE-770
-
CVE-2026-90668
UnrealIRCd 6.2.6 HTTP头部限制缺失致拒绝服务 -
CVE-2026-88012
Traefik: respondingTimeouts.readTimeout is not applied to HT -
CVE-2026-45763
Suricata lua: sandbox allocation limit not enforced for new -
CVE-2026-88878
Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass -
CVE-2023-54394
PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification v
V. Comments for CVE-2026-48496
No comments yet