Remote Code Execution in OpenTelemetry Java Instrumentation

Executive Summary

This vulnerability exists in OpenTelemetry Java Instrumentation versions prior to 2.27.0. It involves the RMI context propagation payload reader, which limits the number of context entries but does not limit the total size of the strings read from the stream.

An attacker who can access an RMI endpoint on a JVM instrumented with OpenTelemetry can send an oversized context propagation payload. Because the payload size is not properly limited, this can cause excessive memory allocation during processing.

This excessive memory allocation can lead to a denial of service condition by exhausting system resources.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects OpenTelemetry Java Instrumentation versions prior to 2.27.0 when RMI instrumentation is enabled and the RMI endpoint is network-reachable. Detection involves identifying if your system is running a vulnerable version with RMI instrumentation enabled and if the RMI endpoint is accessible over the network.

To detect the presence of an exposed RMI endpoint on your system, you can use network scanning tools such as nmap with the following command to scan for open RMI ports (default 1099):

• nmap -p 1099 --open <target-ip>

Additionally, you can attempt to interact with the RMI registry using the Java RMI registry tool to check for responsiveness:

• rmiregistry -J-Djava.rmi.server.hostname=<target-ip> -J-Djava.rmi.server.useCodebaseOnly=true

Review your Java application dependencies or agent versions to confirm if OpenTelemetry Java Instrumentation version is prior to 2.27.0 and if RMI instrumentation is enabled.

Useful 0 Not Useful 0

Impact Analysis

If you are running a Java application instrumented with OpenTelemetry that has RMI instrumentation enabled and the RMI endpoint is reachable over the network, this vulnerability can be exploited by an attacker.

The impact is a potential denial of service caused by excessive memory allocation when processing an oversized context propagation payload sent by the attacker.

This could lead to application crashes, degraded performance, or unavailability of services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability described in CVE-2026-54712 causes a denial of service through excessive memory allocation when an attacker sends an oversized context propagation payload to an RMI endpoint on an instrumented JVM. It does not involve unauthorized access, data leakage, or modification of data.

Since the vulnerability does not impact confidentiality or integrity of data, it does not directly affect compliance with data protection regulations such as GDPR or HIPAA, which primarily focus on protecting personal and sensitive data.

However, denial of service incidents can indirectly affect availability requirements under some standards, so organizations relying on OpenTelemetry Java Instrumentation with RMI enabled should consider this risk in their availability and incident response planning.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your OpenTelemetry Java Instrumentation version is updated to 2.27.0 or later.

Additionally, if RMI instrumentation is enabled and RMI endpoints are network-reachable, consider disabling RMI instrumentation or restricting network access to RMI endpoints until the update can be applied.

Useful 0 Not Useful 0