The vulnerability is an integer overflow in the memcached text protocol parser of the OpenTelemetry eBPF instrumentation, which can be triggered by sending excessively large <bytes> values in storage commands such as set, add, replace, append, prepend, or cas. This overflow causes the computed payload length to wrap to a negative value, leading to a runtime panic in LargeBufferReader.Peek. The result is a crash of the OBI process, causing denial of service. The weakness is classified as integer overflow (CWE‑190).

Affected are all installations of OpenTelemetry eBPF instrumentation between version 0.7.0 and any release prior to 0.9.0. The flaw is fixed starting with version 0.9.0.

The CVSS base score of 7.5 indicates a high severity. No EPSS score is available, but the attack vector is remote and requires the ability to send memcached text protocol commands to the OBI instance. The vulnerability was not listed in the CISA KEV catalog. An attacker could send a crafted request containing a <bytes> value of the maximum 64‑bit integer or one less, causing a crash that results in denial of service until the service is restarted. The main risk is service interruption for the affected environment rather than data theft or privilege escalation.