CVE-2026-54712
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability in OpenTelemetry Java Instrumentation before version 2.27.0 allows an attacker to send an oversized RMI context propagation payload, causing excessive memory allocation and potential denial of service (DoS). This issue affects only deployments with RMI instrumentation enabled and a network-reachable RMI endpoint.
Risk Assessment
An attacker can exhaust memory on the Java application server, leading to service unavailability. The risk is particularly high in critical systems where availability is essential.
Recommendation
Upgrade OpenTelemetry Java Instrumentation to version 2.27.0 or later immediately. If an upgrade is not possible, consider disabling RMI instrumentation or restricting network access to RMI endpoints.
Other vulnerabilities in OpenTelemetry Java Instrumentation
See all- CVE-2026-33701Critical
A vulnerability in OpenTelemetry Java Instrumentation prior to 2.26.1 allows remote code execution (RCE) via deserialization of untrusted data in the RMI registration. The attack requires JDK 16 or earlier, an explicitly configured JMX/RMI port, and a gadget-chain library on the classpath.
- CVE-2026-54704Medium
A vulnerability in OpenTelemetry Java Instrumentation prior to version 2.28.0 causes JDBC auto-instrumentation to fail sanitizing passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.
- CVE-2023-39951Medium
OpenTelemetry Java Instrumentation prior to version 1.28.0 has an issue related to the instrumentation of Java applications using AWS SDK v2 with Amazon Simple Email Service (SES) v1 API. When instrumenting POST requests to SES, query parameters are inserted into the `url.path` field, leading to the email content being present in telemetry metadata.
Original NVD description (English source)
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive memory allocation while the JVM reads the payload, potentially leading to denial of service. The issue affects only deployments where RMI instrumentation is enabled and an RMI endpoint is network-reachable. This issue has been fixed in version 2.27.0.