CVE-2026-54712Disclosure(linuxfoundation / opentelemetry_instrumentation_for_java)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive memory allocation while the JVM reads the payload, potentially leading to denial of service. The issue affects only deployments where RMI instrumentation is enabled and an RMI endpoint is network-reachable. This issue has been fixed in version 2.27.0.

linuxfoundation CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-fq3f-m5qm-99f5

Weakness type (CWE)

CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

opentelemetry_instrumentation_for_java

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

linuxfoundation

Products

opentelemetry_instrumentation_for_java

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets2 URLs

By indicator

Full discourse1 post

Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-54712 Denial of Service via Oversized RMI Context Propagation in OpenTe... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54712 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
CVE‑2026‑54712 is a newly disclosed denial‑of‑service flaw involving oversized RMI context propagation in OpenTe, with no PoC, exploit or patch information presented in the tweet.
00010113
4.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	linuxfoundation	opentelemetry_instrumentation_for_java	-	-	-

Explore more

Back to dashboard linuxfoundation CVEs opentelemetry_instrumentation_for_java vulnerabilities