What is the CVSS score of CVE-2026-54712?

CVE-2026-54712 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of OpenTelemetry Java Instrumentation are affected by CVE-2026-54712?

OpenTelemetry Java Instrumentation versions before 2.27.0 contain a denial-of-service vulnerability in the RMI context-propagation handler that allows remote attackers to crash or stall instrumented…. A patch is available.

Is there a public PoC exploit available for CVE-2026-54712?

Yes, a public proof-of-concept exploit is available for CVE-2026-54712. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-54712?

Within 24 hours: Identify all systems running OpenTelemetry Java Instrumentation versions prior to 2.27.0, prioritizing those with exposed or reachable RMI endpoints. Within 7 days: Deploy patches to upgrade all affected instances to version 2.27.0 or later. Within 30 days: Conduct full inventory verification and implement network access controls restricting RMI endpoint access to trusted hosts only.

OpenTelemetry Java Instrumentation CVE-2026-54712

EUVD-2026-41152 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-01 GitHub_M

GHSA-fq3f-m5qm-99f5

Denial Of Service Java Opentelemetry Java Instrumentation Open Telemetry

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated low-complexity network reach to an RMI endpoint gives AV:N/AC:L/PR:N; impact is availability-only memory exhaustion (A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 17:14 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 17:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 17:07 vuln.today

cvss_changed

Severity Changed

Jul 06, 2026 - 17:07 NVD

MEDIUM HIGH

CVSS changed

Jul 06, 2026 - 17:07 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Patch available

Jul 01, 2026 - 23:02 EUVD

Analysis Generated

Jul 01, 2026 - 22:24 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on io.opentelemetry.javaagent:opentelemetry-javaagent (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.27.0.

DescriptionNVD

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive memory allocation while the JVM reads the payload, potentially leading to denial of service. The issue affects only deployments where RMI instrumentation is enabled and an RMI endpoint is network-reachable. This issue has been fixed in version 2.27.0.

AnalysisAI

Denial of service in OpenTelemetry Java Instrumentation before 2.27.0 lets an attacker who can reach an RMI endpoint on an instrumented JVM send an oversized context-propagation payload that triggers excessive memory allocation. The RMI payload reader caps the number of context entries but never bounds the aggregate size of the strings it reads, so a single crafted request can exhaust heap and crash or stall the JVM. No public exploit is identified at time of analysis, EPSS is low (0.24%), and CISA SSVC records no observed exploitation, but the flaw is network-reachable and unauthenticated wherever RMI instrumentation is enabled and exposed.

Technical ContextAI

OpenTelemetry Java Instrumentation is the auto-instrumentation agent and library set that transparently adds tracing and metrics to Java applications, including an RMI (Java Remote Method Invocation) module that reads and writes OpenTelemetry context across remote calls. The vulnerable code is the RMI context-propagation payload reader: it enforces a limit on the count of context entries but applies no limit on the cumulative size of the strings deserialized from the stream, an instance of CWE-400 (Uncontrolled Resource Consumption). Because the reader allocates memory proportional to attacker-controlled string lengths before any total-size check, a large payload forces unbounded heap allocation on the receiving JVM. The affected component is cpe:2.3:a:open-telemetry:opentelemetry-java-instrumentation, versions prior to 2.27.0.

RemediationAI

Vendor-released patch: 2.27.0 - upgrade the OpenTelemetry Java agent/instrumentation dependency to 2.27.0 or later, which adds an aggregate size limit on strings read from the RMI context-propagation payload; see GHSA-fq3f-m5qm-99f5 (https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-fq3f-m5qm-99f5). Where an immediate upgrade is not possible, reduce exposure by disabling the RMI instrumentation module so the vulnerable reader is never invoked (trade-off: loss of trace context propagation across RMI calls), and by restricting network access to RMI endpoints via firewall or security-group rules or binding RMI to loopback/internal interfaces only (trade-off: breaks legitimate remote RMI clients that must reach the endpoint). As defense against memory exhaustion, ensure JVM heap limits and out-of-memory restart or health-check policies are in place so a triggered DoS is contained and recovers.