CVE-2026-45678
📛 CVE Title
(no title)
Description
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
Description (MITRE) cveawg.mitre.org
Pulled from cveawg.mitre.org/api/cve/CVE-2026-45678 on 2026-08-01. Shown when MITRE's text differs from the cvelistV5 mirror.
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- high
- CVSS score
- 7.5 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Effective score
- 7.5 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-45678
- Linked Threat
- CVE-2026-45678 — CVE-2026-45678
NVD / KEV / EPSS data refreshed 2026-05-25 00:11 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-33952 - Assigner
- GitHub_M
- Published
- Jun 2, 2026, 3:24:12 PM
- Updated
- Jun 2, 2026, 3:54:32 PM
- EUVD base score (CVSS 3.1)
-
7.5 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EUVD-reported EPSS
- 0.3400
- Vendors
- open-telemetry
- Products
-
opentelemetry-ebpf-instrumentation (< 0.9.0)
- Aliases
-
GHSA-pgvv-q3wf-mm9m
ENISA description: OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (4)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 tenable:github.com
- https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-pgvv-q3wf-mm9m tenable:github.com
- https://nvd.nist.gov/vuln/detail/CVE-2026-45678 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-45678 tenable:www.cve.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:4sysops.com
Starting in April 2026 , Windows updates will change the default Kerberos ticket issuance behavior to AES-SHA1 for accounts without explicit encryption settings, while RC4 can still be used where explicitly enabled. This change, driven by CVE - 2026 -20833, affects every Windows Server environment where service accounts or devices still rely on RC4. Any service account, NAS device, or legacy ...
2026-05-26 02:57 UTC -
web:chromereleases.googleblog.com
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix . We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed. This update includes 21 security fixes. Please see the Chrome Security Page for more information.
2026-05-26 02:57 UTC -
web:community.ui.com
Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...
2026-05-26 02:57 UTC -
web:cyberpress.org
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .
2026-05-26 02:57 UTC -
web:experienceleague.adobe.com
Learn about security bug fixes, security enhancements, and other security related updates included in the security patch releases for Adobe Commerce version 2.4.6.
2026-05-26 02:57 UTC -
web:github.com
Contribute to acidanthera/NVMeFix development by creating an account on GitHub.
2026-05-26 02:57 UTC -
web:guide.sonatype.com
Technical security analysis for CVE-2026-45678 . CVSS 7.5 severity. View CVSS vectors, CWE classifications, and exploit maturity ratings.
2026-05-26 02:57 UTC -
web:support.microsoft.com
This out-of-band update for Windows 11, version 25H2 and 24H2 (KB5085518) includes fixes and improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates ...
2026-05-26 02:57 UTC -
web:thehackernews.com
Microsoft patched 138 flaws, including 30 Critical bugs, as AI discovery expands Patch Tuesday risk.
2026-05-26 02:57 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-26 02:57 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.