EUVD-2026-41152
GHSA-fq3f-m5qm-99f5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate reachable RMI endpoint on instrumented JVM
-
DeliveryCraft oversized context propagation payload
-
ExploitSend payload to RMI reader
-
ExecutionForce unbounded memory allocation
-
ImpactExhaust JVM heap and crash service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target deployment has OpenTelemetry RMI instrumentation enabled AND an RMI endpoint that is network-reachable by the attacker - the exact, named prerequisite from the advisory, and NOT a default configuration. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed once the endpoint is reachable, and the malicious payload deliberately stays within the entry-count limit while exceeding the previously unenforced aggregate string-size limit. Limiting factors that reduce realistic risk: the non-default requirement to enable RMI instrumentation, the need for the RMI port to be exposed rather than firewalled or loopback-bound, running an affected version below 2.27.0, and impact confined to availability (no confidentiality or integrity loss). |
| Impact | Signals are consistent and point to a genuine but conditional availability risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) reflects unauthenticated, low-complexity network reachability with high availability impact and no confidentiality or integrity effect. CISA SSVC aligns: Exploitation=none (no observed activity), Automatable=yes (a scripted flood is trivial once an endpoint is found), and Technical Impact=partial (DoS only, no code execution or data exposure). EPSS is low at 0.24% (15th percentile), there is no KEV listing, and no public exploit is identified, so widespread opportunistic exploitation is unlikely near-term. A key limiting factor not captured by the raw CVSS score is that exposure requires RMI instrumentation to be enabled AND an RMI endpoint to be network-reachable - not a default posture - so the real-world attack surface is narrower than 7.5 implies. |
| Exploit ScenarioDerived | An attacker who can reach an instrumented JVM's exposed RMI port crafts a context-propagation payload that stays under the entry-count cap but contains very large string values, then sends it repeatedly. Each request forces the payload reader to allocate memory proportional to the oversized strings, exhausting heap and driving the target JVM into severe garbage-collection pressure or an OutOfMemoryError, taking the service offline. No public exploit is identified at time of analysis, and given AV:N/AC:L/PR:N the attack needs only network reachability and no authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 06, 2026
Denial of service in OpenTelemetry Java Instrumentation before 2.27.0 lets an attacker who can reach an RMI endpoint on an instrumented JVM send an oversized context-propagation payload that triggers excessive memory allocation. The RMI payload reader caps the number of context entries but never bounds the aggregate size of the strings it reads, so a single crafted request can exhaust heap and crash or stall the JVM. No public exploit is identified at time of analysis, EPSS is low (0.24%), and CISA SSVC records no observed exploitation, but the flaw is network-reachable and unauthenticated wherever RMI instrumentation is enabled and exposed.
Earlier versions of this analysis (2)
Uncontrolled memory allocation in OpenTelemetry Java Instrumentation before 2.27.0 lets a remote attacker who can reach an RMI endpoint on an instrumented JVM crash the process via denial of service. The RMI context propagation payload reader caps the number of context entries but never bounds the aggregate string size read from the stream, so an oversized payload forces excessive heap allocation. No public exploit identified at time of analysis; EPSS is low (0.24%, 15th percentile) and CISA SSVC records exploitation status as none, though the flaw is rated automatable.
Denial of service in OpenTelemetry Java Instrumentation (all versions prior to 2.27.0) allows unauthenticated remote attackers to exhaust JVM heap memory by sending an oversized RMI context propagation payload. The RMI instrumentation component caps the number of context entries it processes but imposes no limit on the cumulative byte length of strings read from the stream, creating an unbounded memory allocation path. Exploitation is constrained to deployments where RMI instrumentation is explicitly enabled and the RMI endpoint is reachable from an untrusted network; no public exploit code or confirmed active exploitation has been identified at time of analysis.
RemediationAI
Vendor-released patch: 2.27.0 - upgrade the OpenTelemetry Java agent/instrumentation dependency to 2.27.0 or later, which adds an aggregate size limit on strings read from the RMI context-propagation payload; see GHSA-fq3f-m5qm-99f5 (https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-fq3f-m5qm-99f5). Where an immediate upgrade is not possible, reduce exposure by disabling the RMI instrumentation module so the vulnerable reader is never invoked (trade-off: loss of trace context propagation across RMI calls), and by restricting network access to RMI endpoints via firewall or security-group rules or binding RMI to loopback/internal interfaces only (trade-off: breaks legitimate remote RMI clients that must reach the endpoint). As defense against memory exhaustion, ensure JVM heap limits and out-of-memory restart or health-check policies are in place so a triggered DoS is contained and recovers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenTelemetry Java Instrumentation is the auto-instrumentation agent and library set that transparently adds tracing and metrics to Java applications, including an RMI (Java Remote Method Invocation) module that reads and writes OpenTelemetry context across remote calls. The vulnerable code is the RMI context-propagation payload reader: it enforces a limit on the count of context entries but applies no limit on the cumulative size of the strings deserialized from the stream, an instance of CWE-400 (Uncontrolled Resource Consumption). Because the reader allocates memory proportional to attacker-controlled string lengths before any total-size check, a large payload forces unbounded heap allocation on the receiving JVM. The affected component is cpe:2.3:a:open-telemetry:opentelemetry-java-instrumentation, versions prior to 2.27.0.
Know when Opentelemetry Java Instrumentation gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated low-complexity network reach to an RMI endpoint gives AV:N/AC:L/PR:N; impact is availability-only memory exhaustion (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive memory allocation while the JVM reads the payload, potentially leading to denial of service. The issue affects only deployments where RMI instrumentation is enabled and an RMI endpoint is network-reachable. This issue has been fixed in version 2.27.0.
Blast Radius
ecosystem impact- 3 maven packages depend on io.opentelemetry.javaagent:opentelemetry-javaagent (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.27.0.
Executive ViewAI
OpenTelemetry Java Instrumentation versions before 2.27.0 contain a denial-of-service vulnerability in the RMI context-propagation handler that allows remote attackers to crash or stall instrumented JVM applications through crafted payload injection. No public exploit has been identified, but the vulnerability is network-accessible and affects any organization running affected versions with exposed RMI endpoints.
Vendor-released patch: OpenTelemetry Java Instrumentation 2.27.0 or later. Interim: Disable RMI instrumentation if not required; restrict network access to RMI endpoints at firewall/network boundary.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB