PT-2026-54845 · Unknown · @Opentelemetry/Instrumentation

Decsecre583 · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-54712

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions OpenTelemetry Java Instrumentation versions prior to 2.27.0

Description An issue exists in the RMI context propagation payload reader where the number of context entries is limited, but the aggregate size of the strings read from the stream is not. An attacker capable of reaching an RMI endpoint on an instrumented JVM can send an oversized context propagation payload, causing excessive memory allocation and potentially leading to a denial of service. This affects deployments where RMI instrumentation is enabled and the RMI endpoint is network-reachable.

Recommendations Update to version 2.27.0. As a temporary mitigation, disable RMI instrumentation or restrict network access to the RMI endpoint.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-54712

Affected Products

@Opentelemetry/Instrumentation

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-54712 · Security Note
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-fq3f-m5qm-99f5 · Note
• https://twitter.com/VulmonFeeds/status/2072455304525090880 · Twitter Post
• https://t.me/cveNotify/184183 · Telegram Post