OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

CVE-2026-45686

### Summary A remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

CVE-2026-45685

### Summary Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote un

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers

CVE-2026-45684

### Summary OBI's log enricher mishandles `writev` buffers by reading only the first `iovec` entry but using the total

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

CVE-2026-45682

### Summary The custom `CappedConcurrentHashMap` introduced for Java TLS state tracking never removes keys from its ins

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

CVE-2026-45683

### Summary The Java TLS ioctl probe reads user-controlled ioctl pointers with `bpf_probe_read` instead of `bpf_probe_r

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

CVE-2026-45681

### Summary The per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload s

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

CVE-2026-45680

### Summary OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy syst

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

CVE-2026-45678

### Summary The Postgres protocol parser assumes `BIND` message payloads contain a valid NUL-terminated portal name. A

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

CVE-2026-45679

### Summary OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attack

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

CVE-2026-45676

### Summary OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A

历史摘要 · 未重新核验 · GitHub Advisory

Docker: Race condition in docker cp allows bind mount redirection to host path

CVE-2026-42306

## Summary A race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target

历史摘要 · 未重新核验 · GitHub Advisory

Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

CVE-2026-41568

## Summary A race condition during `docker cp` mount setup allows a malicious container to create empty files or direct

历史摘要 · 未重新核验 · GitHub Advisory

Docker: `PUT /containers/{id}/archive` executes container binary on the host

CVE-2026-41567

## Summary When a user uploads a compressed archive into a container, a malicious image can execute arbitrary code with

历史摘要 · 未重新核验 · GitHub Advisory

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

CVE-2026-45327

## Title Missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection in TinyIce ## Ecosys

历史摘要 · 未重新核验 · GitHub Advisory

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

CVE-2026-45298

## Summary In a default dozzle deploy (the documented quickstart, no `DOZZLE_AUTH_PROVIDER` set), `POST /api/notificati

历史摘要 · 未重新核验 · GitHub Advisory

iskorotkov/avro: CPU Exhaustion in Decoder

CVE-2026-46385

# CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration ## Summary The Avro array and map decoders looped

历史摘要 · 未重新核验 · GitHub Advisory

iskorotkov/avro: Integer Overflow in Decoder

CVE-2026-46384

# Integer Overflow in Avro Decoder ## Summary Several Avro decoder paths read attacker-controlled 64-bit values from t

历史摘要 · 未重新核验 · GitHub Advisory

iskorotkov/avro: Denial-of-Service Vulnerability in Decoder

# Memory Exhaustion via Unbounded Map Allocations in Avro Decoder ## Summary The Avro map decoder accepted attacker-co

历史摘要 · 未重新核验 · GitHub Advisory

arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS

### Summary Three medium-severity issues in arnika affecting the UDP key-rotation protocol, PQC key file handling, and K

历史摘要 · 未重新核验 · GitHub Advisory

goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request

### Summary The `--tunnel` / `-t` flag opens an outbound SSH connection to `localhost.run:22` with `HostKeyCallback: ss

历史摘要 · 未重新核验 · GitHub Advisory