CVE-2026-48496
- Source
- https://cve.org/CVERecord?id=CVE-2026-48496
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48496.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-48496
- Aliases
- Downstream
CGA (23)
- CGA-22jc-cvpp-cjfm
- CGA-2jp6-pf4g-p57q
- CGA-35x6-84m8-8wfw
- CGA-3mqc-8c2j-r3mp
- CGA-3mxv-v9q9-49fx
- CGA-49v3-3g3f-jgv5
- CGA-5mr5-2v4f-cmjw
- CGA-75wf-2wqv-j2f8
- CGA-8r2c-9c8f-mjxr
- CGA-952v-vhjj-gg8p
- CGA-9w66-r24g-hg2c
- CGA-f28f-c364-jjjv
- CGA-frfq-q97h-3jjv
- CGA-g7x5-4x86-p94r
- CGA-g8ff-97f4-67rv
- CGA-ggx9-97wc-943w
- CGA-hgj4-8xwv-j327
- CGA-mcmg-mcg4-wx9r
- CGA-pm48-h54g-q4rx
- CGA-qggx-vf7q-5r79
- CGA-wqgw-c69p-p2jw
- CGA-xj2w-f3pf-xc92
- CGA-xvmq-pw7q-f3w9
CLEANSTART (4)
MINI (5)
SUSE (1)
- Related
- Published
- 2026-09-11T21:16:42Z
- Modified
- 2026-10-15T02:51:44Z
- Severity
-
- 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
- Details
-
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-770" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48496.json" }- References
-
- https://github.com/open-telemetry/opentelemetry-ebpf-profiler/releases/tag/v0.0.202622
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48496.json
- https://github.com/open-telemetry/opentelemetry-ebpf-profiler/security/advisories/GHSA-f2r5-5m7w-p5cx
- https://nvd.nist.gov/vuln/detail/CVE-2026-48496
- https://github.com/open-telemetry/opentelemetry-ebpf-profiler/commit/234b685cab31c2cb2f79e966caeab168bcc489e4
Affected packages
Git / github.com/open-telemetry/opentelemetry-ebpf-profiler
Affected ranges
- Type
- GIT
- Repo
- https://github.com/open-telemetry/opentelemetry-ebpf-profiler
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.0.202527" }, { "fixed": "0.0.202622" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "234b685cab31c2cb2f79e966caeab168bcc489e4" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v0.0.202622", "range": [ { "fixed": "6c1e630a2efc6b632ff27ffd9ebd12ea67a01fe9" } ], "source": "REFERENCES_TAG" } ] }