{"vulnerability": "ghsa-fq3f-m5qm-99f5", "sightings": [{"uuid": "c3159856-fdc3-4a76-aa46-efc43eb2fc34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-fq3f-m5qm-99f5", "type": "seen", "source": "https://gist.github.com/alon710/e40fc20ed683aaeeae74fc5b1a713445", "content": "# CVE-2026-54712: CVE-2026-54712: Uncontrolled Resource Consumption in OpenTelemetry Javaagent RMI Context Propagation\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54712\n\n## Summary\nAn uncontrolled resource consumption vulnerability in the OpenTelemetry Javaagent RMI context propagation mechanism allows remote unauthenticated attackers to cause a Denial of Service (DoS) via heap memory exhaustion.\n\n## TL;DR\nOpenTelemetry Javaagent prior to 2.27.0 allows unauthenticated remote attackers to trigger heap memory exhaustion and Denial of Service (DoS) by sending oversized RMI context propagation payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Vulnerability Type**: Uncontrolled Resource Consumption\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenTelemetry Javaagent\n- OpenTelemetry Java Instrumentation\n- **OpenTelemetry Java Instrumentation**: >= 2.26.1, < 2.27.0 (Fixed in: `2.27.0`)\n\n## Mitigation\n\n- Upgrade OpenTelemetry Javaagent to version 2.27.0 or later.\n- Disable RMI instrumentation via configuration.\n- Restrict network access to RMI ports using firewalls and security groups.\n\n**Remediation Steps:**\n1. Identify all JVM instances running with the OpenTelemetry Javaagent in versions >= 2.26.1 and < 2.27.0.\n2. If immediate upgrade is possible, download the 2.27.0 Javaagent jar and replace the existing agent jar.\n3. If immediate upgrade is not possible, apply the JVM system property `-Dotel.instrumentation.rmi.enabled=false` or set the environment variable `OTEL_INSTRUMENTATION_RMI_ENABLED=false`.\n4. Restart the affected Java Virtual Machine to apply the changes.\n5. Verify that RMI registry and endpoint ports are firewalled and inaccessible to untrusted external networks.\n\n## References\n\n- [GHSA-fq3f-m5qm-99f5: Uncontrolled Resource Consumption in OpenTelemetry Javaagent RMI Context Propagation](https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-fq3f-m5qm-99f5)\n- [Remediation Patch Pull Request (#17870)](https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/17870)\n- [Remediation Commit (6ef1880)](https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/6ef18806d5daa4913619e4cb33d2d7ed6a853c22)\n- [Official Release v2.27.0](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.27.0)\n- [NVD Official Vulnerability Record (CVE-2026-54712)](https://nvd.nist.gov/vuln/detail/CVE-2026-54712)\n- [CVE.org Authoritative Vulnerability Detail](https://www.cve.org/CVERecord?id=CVE-2026-54712)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54712) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T20:31:26.699021Z"}]}