---
id: CVE-2026-48496
title: >-
  OpenTelemetry eBPF Profiler is a production-scale agent for profiling
  applications across multiple programming languages
summary: "OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527\_and prior to version 0.0.202622, an unprivileged process can cause the profiler to o…"
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: open-telemetry
product: opentelemetry-ebpf-profiler
affected:
  - 'opentelemetry-ebpf-profiler >= 0.0.202527, < 0.0.202622'
patched:
  - go.opentelemetry.io/ebpf-profiler 0.0.202622
published: '2026-09-11'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T14:23:59.847'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48496'
references:
  - url: >-
      https://github.com/open-telemetry/opentelemetry-ebpf-profiler/commit/234b685cab31c2cb2f79e966caeab168bcc489e4
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-telemetry/opentelemetry-ebpf-profiler/releases/tag/v0.0.202622
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-telemetry/opentelemetry-ebpf-profiler/security/advisories/GHSA-f2r5-5m7w-p5cx
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-f2r5-5m7w-p5cx'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
epss: 0.00184
epssPercentile: 0.07066
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T19:55:51.663762Z'
ingestedAt: '2026-06-26T16:43:14.601Z'
---

## Overview

OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-48496)

Affected packages:

- `go.opentelemetry.io/ebpf-profiler >= 0.0.202527, < 0.0.202622`

Patched in:

- `go.opentelemetry.io/ebpf-profiler 0.0.202622`

Source: https://github.com/advisories/GHSA-f2r5-5m7w-p5cx