{"id":"CVE-2026-48496","title":"OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages","summary":"OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to o…","severity":"medium","cvss":6.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770","CWE-66"],"vendor":"open-telemetry","product":"opentelemetry-ebpf-profiler","affected":["opentelemetry-ebpf-profiler >= 0.0.202527, < 0.0.202622"],"patched":["go.opentelemetry.io/ebpf-profiler 0.0.202622"],"published":"2026-09-11","updated":"2026-09-25","sourceUpdated":"2026-09-25T14:23:59.847","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48496","references":[{"url":"https://github.com/open-telemetry/opentelemetry-ebpf-profiler/commit/234b685cab31c2cb2f79e966caeab168bcc489e4","label":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/opentelemetry-ebpf-profiler/releases/tag/v0.0.202622","label":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/opentelemetry-ebpf-profiler/security/advisories/GHSA-f2r5-5m7w-p5cx","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-f2r5-5m7w-p5cx"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48496.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-48496"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532291"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48496"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48496"}],"tags":["nvd","cve.org","ghsa","go","csaf","vex","red-hat"],"epss":0.00137,"epssPercentile":0.03082,"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T19:55:51.663762Z"},"ingestedAt":"2026-06-26T16:43:14.601Z","slug":"CVE-2026-48496","body":"## Overview\n\nOpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-48496)\n\nAffected packages:\n\n- `go.opentelemetry.io/ebpf-profiler >= 0.0.202527, < 0.0.202622`\n\nPatched in:\n\n- `go.opentelemetry.io/ebpf-profiler 0.0.202622`\n\nSource: https://github.com/advisories/GHSA-f2r5-5m7w-p5cx\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48496.json)","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}