CVE-2026-48496 opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
An unprivileged process can cause the OpenTelemetry eBPF Profiler to block indefinitely by opening a FIFO, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48496?
CVE-2026-48496 is a medium-severity denial of service vulnerability in open-telemetry opentelemetry-ebpf-profiler, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.
Weakness: CWE-770
Which versions are affected by CVE-2026-48496?
3 open source packages ship an affected version, including go.opentelemetry.io/ebpf-profiler.
| Package | Affected | Fixed in |
|---|---|---|
go.opentelemetry.io/ebpf-profiler Go | From 0.0.202527 | 0.0.202622 |
go.opentelemetry.io/ebpf-profiler Go | From 0.0.202527 | 0.0.202622 |
go.opentelemetry.io/ebpf-profiler Go | From 0.0.202527 | 0.0.202622 |
How do I fix CVE-2026-48496?
Upgrade go.opentelemetry.io/ebpf-profiler to 0.0.202622 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48496 being exploited?
There is no known exploitation of CVE-2026-48496 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-BY72509, CLEANSTART-2026-LX44302, CLEANSTART-2026-MV27446, CLEANSTART-2026-OS96290, CLEANSTART-2026-XW68310, ECHO-4cc0-1065-45dd and 7 more.