CVE-2026-45685 affects OpenTelemetry eBPF Instrumentation versions 0.1.0 to before 0.9.0. Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing remote unauthenticated attackers to crash the telemetry agent and cause denial of service. The vulnerability occurs because the parser processes raw attacker-controlled network payloads before proper validation. A single crafted message can terminate telemetry collection for the affected process or node. The issue has been patched in version 0.9.0.