CVE-2026-45685 affects OpenTelemetry eBPF Instrumentation versions 0.1.0 to before 0.9.0. Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing remote unauthenticated attackers to crash the telemetry agent and cause denial of service. The parser processes raw attacker-controlled network payloads before full validation, enabling a single crafted message to terminate telemetry collection for the affected process or node. This vulnerability has been patched in version 0.9.0.