CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
An unprivileged process can easily trigger the processPIDEvents goroutine to be blocked indefinitely, preventing the goroutine from analyzing any new ELF file. The goroutine stays blocked in the openat2 syscall forever and the profiler can no longer work properly, it is a denial of service.
References
- github.com/advisories/GHSA-f2r5-5m7w-p5cx
- github.com/open-telemetry/opentelemetry-ebpf-profiler/commit/234b685cab31c2cb2f79e966caeab168bcc489e4
- github.com/open-telemetry/opentelemetry-ebpf-profiler/releases/tag/v0.0.202622
- github.com/open-telemetry/opentelemetry-ebpf-profiler/security/advisories/GHSA-f2r5-5m7w-p5cx
- nvd.nist.gov/vuln/detail/CVE-2026-48496
Code Behaviors & Features
Detect and mitigate CVE-2026-48496 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →