OpenTelemetry eBPF Instrumentation contains a CappedConcurrentHashMap that never removes keys from its insertion‑order queue when entries are deleted. In long‑running instrumented JVMs this causes the queue to grow without bound, eventually exhausting heap memory and forcing the JVM to terminate. The weakness corresponds to memory leaks (CWE‑401) and capacity exhaustion (CWE‑770), and the primary impact is a denial of service by exhausting resources.

OpenTelemetry eBPF Instrumentation prior to version 0.9.0 on Java virtual machines.

The CVSS score of 5.1 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in CISA KEV. Attackers would need the ability to run the instrumented application and generate repeated connection churn to trigger the growth of the queue, making this a local or privileged denial of service risk rather than a remote code execution threat.