DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54712: CVE-2026-54712: Uncontrolled Resource Consumption in OpenTelemetry Javaagent RMI Context Propagation

#security #cve #cybersecurity

CVE-2026-54712: Uncontrolled Resource Consumption in OpenTelemetry Javaagent RMI Context Propagation

Vulnerability ID: CVE-2026-54712
CVSS Score: 5.3
Published: 2026-07-29

An uncontrolled resource consumption vulnerability in the OpenTelemetry Javaagent RMI context propagation mechanism allows remote unauthenticated attackers to cause a Denial of Service (DoS) via heap memory exhaustion.

TL;DR

OpenTelemetry Javaagent prior to 2.27.0 allows unauthenticated remote attackers to trigger heap memory exhaustion and Denial of Service (DoS) by sending oversized RMI context propagation payloads.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 5.3 (Medium)
  • Vulnerability Type: Uncontrolled Resource Consumption
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • OpenTelemetry Javaagent
  • OpenTelemetry Java Instrumentation
  • OpenTelemetry Java Instrumentation: >= 2.26.1, < 2.27.0 (Fixed in: 2.27.0)

Mitigation Strategies

  • Upgrade OpenTelemetry Javaagent to version 2.27.0 or later.
  • Disable RMI instrumentation via configuration.
  • Restrict network access to RMI ports using firewalls and security groups.

Remediation Steps:

  1. Identify all JVM instances running with the OpenTelemetry Javaagent in versions >= 2.26.1 and < 2.27.0.
  2. If immediate upgrade is possible, download the 2.27.0 Javaagent jar and replace the existing agent jar.
  3. If immediate upgrade is not possible, apply the JVM system property -Dotel.instrumentation.rmi.enabled=false or set the environment variable OTEL_INSTRUMENTATION_RMI_ENABLED=false.
  4. Restart the affected Java Virtual Machine to apply the changes.
  5. Verify that RMI registry and endpoint ports are firewalled and inaccessible to untrusted external networks.

References

Read the full report for CVE-2026-54712 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)