CVE-2026-45682

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions prior to 0.9.0

Description A memory leak exists in the custom CappedConcurrentHashMap used for Java TLS state tracking. The remove() function deletes entries from the map but fails to remove the corresponding keys from the insertion-order queue. In long-running instrumented JVMs with frequent connection churn, this queue grows without bound, potentially leading to long garbage collection pauses or heap memory exhaustion resulting in an OutOfMemoryError.

Recommendations Update to version 0.9.0.