GHSA-f2r5-5m7w-p5cxPublished

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

cve-program · CVE-2026-48496

Published

opentelemetry-ebpf-profiler

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "open-telemetry",
                    "product": "opentelemetry-ebpf-profiler",
                    "versions": [
                        {
                            "version": ">= 0.0.202527, < 0.0.202622",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-76762

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 11, 2026, 9:16:42 PM

dateUpdated: Sep 14, 2026, 7:55:59 PM

3 related source bulletins · separate from aliases

openSUSE-SU-2026:22032-1: Security update for alloy

CVE-2026-2303 · CVE-2026-37236 · CVE-2026-41178 · CVE-2026-45679 · CVE-2026-45680 · CVE-2026-45681 · CVE-2026-45683 · CVE-2026-45684 · CVE-2026-46600 · CVE-2026-48496 · CVE-2026-56852 · CVE-2026-56854 · CVE-2026-56855 · CVE-2026-71556 · CVE-2026-71557 · CVE-2026-75889 · CVE-2026-78662 · CVE-2026-81521 · CVE-2026-89090

SUSE-SU-2026:24148-1: Security update for alloy

openSUSE-SU-2026:11803-1: alloy-1.19.2-1.1 on GA media

CVE-2026-2303 · CVE-2026-37236 · CVE-2026-41178 · CVE-2026-45679 · CVE-2026-45680 · CVE-2026-45681 · CVE-2026-45683 · CVE-2026-45684 · CVE-2026-46600 · CVE-2026-48496 · CVE-2026-56852 · CVE-2026-56854 · CVE-2026-71556 · CVE-2026-71557 · CVE-2026-75889 · CVE-2026-75890 · CVE-2026-81521 · CVE-2026-89090

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-48496

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-770

Original publisher date fields

published: 2026-09-11T22:16:37.400

lastModified: 2026-09-25T14:23:59.847

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-f2r5-5m7w-p5cx

Published

go.opentelemetry.io/ebpf-profiler

SEMVER · introduced 0.0.202527 → fixed 0.0.202622

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2026-5343

Published

go.opentelemetry.io/ebpf-profiler

SEMVER · introduced 0.0.202527 → fixed 0.0.202622

Original source record · Cite this exact observation · Complete original publisher JSON