Unbounded BPF probe replay loop causes CPU exhaustion in OBI (CVE-2026-45680)

OBI (go.opentelemetry.io/obi) replays BPF probe hits into histogram observations by iterating once per recorded run-count delta during each metrics collection interval. On busy systems, an uncapped delta between scrape intervals causes the metrics exporter to consume CPU time proportional to probe hit volume rather than metric series count. Deployments that enable BPF internal metrics and trace high-throughput workloads are at risk of availability degradation, as an attacker can indirectly exhaust CPU in the privileged agent by generating sufficient activity through instrumented services. Affected versions: - > v0.0.0-rc.1+build We recommend updating to: v0.9.0. CVSS 7.5 · our assessment: this_week Reference: https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-89c6-vpcj-7vj4 Details: https://vuln.today/cve/CVE-2026-45680