Opentelemetry Instrumentation For Java vulnerabilities

2 known vulnerabilities in Opentelemetry Instrumentation For Java from Linux Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  opentelemetry-java-instrumentation: Uncontrolled Resource Consumption

  CVE-2026-54712Jul 1, 2026Open-telemetry

  OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate

• 9.8 Critical severity

  opentelemetry-java-instrumentation: Deserialization of Untrusted Data

  CVE-2026-33701Mar 27, 2026Open-telemetry

  OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serializat