OpenTelemetry eBPF Instrumentation's Postgres protocol parser assumed that BIND message payloads always contained a valid NUL-terminated portal name. Versions before 0.9.0 did not validate this assumption, allowing specially crafted empty or unterminated payloads to cause the parser to slice beyond the captured buffer's end, resulting in a panic. This is classified under CWE-20 (Improper Input Validation) and CWE-754 (Improper Check for Unusual or Exceptional Conditions). The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, primarily due to its potential to cause denial of service by crashing the instrumentation process. The issue is patched in version 0.9.0.

The vulnerability can cause a denial of service by crashing the OpenTelemetry eBPF instrumentation process when processing malformed Postgres BIND messages. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

Upgrade OpenTelemetry eBPF Instrumentation to version 0.9.0 or later, where this vulnerability is patched. Since the vendor advisory indicates the issue is fixed in 0.9.0, applying this official fix fully mitigates the vulnerability. No other mitigation steps are specified.