CVE-2026-54712: OpenTelemetry Java RMI DoS Vulnerability – Patch to 2.27.0

Technical summary

The vulnerability exists in the RMI context propagation payload reader, which validates the number of context entries but fails to enforce limits on the aggregate size of serialized strings extracted from the input stream. When processing a malicious payload containing large strings, the JVM performs unbounded memory allocation during deserialization. An unauthenticated attacker on the network can trigger this condition by sending a crafted RMI request to a reachable instrumented endpoint. The issue is classified as unintended resource consumption (CWE-400) and was remediated in version 2.27.0 by implementing proper aggregate size validation.

Business impact

Organizations relying on OpenTelemetry Java Instrumentation for observability in production environments face availability risk. A successful attack can cause sudden memory exhaustion, triggering garbage collection pauses or out-of-memory errors that disrupt service. The impact is particularly severe for latency-sensitive applications or those running on resource-constrained infrastructure. Financial services, real-time systems, and high-traffic platforms should prioritize patching to maintain SLA compliance.

Affected systems

The vulnerability affects OpenTelemetry Instrumentation for Java in all versions prior to 2.27.0. Only JVMs where RMI instrumentation is actively enabled and configured are vulnerable. Standard deployments using other instrumentation modules (e.g., HTTP, database, messaging) are not affected. Verify RMI instrumentation status in your OpenTelemetry configuration and dependency tree.

Exploitability

Exploitability is straightforward for attackers with network access to an RMI port. The attack requires no authentication, no user interaction, and no special privileges—only the ability to send a crafted network packet to the exposed RMI endpoint. However, the vulnerability is not remotely exploitable unless the RMI endpoint is deliberately exposed to untrusted networks, which is rare in properly segmented infrastructures. Internal network access or exposed cloud deployments represent the primary risk.

Remediation

Upgrade OpenTelemetry Instrumentation for Java to version 2.27.0 or later. This release includes input validation to enforce aggregate size limits on context propagation payloads. If immediate patching is not feasible, restrict network access to RMI endpoints using firewall rules, VPNs, or security groups to limit exposure to trusted internal networks only. Disabling RMI instrumentation if not required is also an effective mitigation.

Patch guidance

Apply the OpenTelemetry Instrumentation for Java 2.27.0 update following your standard dependency management workflow (Maven, Gradle, or manual JAR replacement). Verify the upgrade by checking the instrumentation agent version in startup logs or via JMX inspection. Test in a non-production environment first, particularly if your application relies on RMI for critical functions. No breaking changes are documented in the 2.27.0 release; standard compatibility expectations apply.

Detection guidance

Monitor JVM metrics for sudden memory pressure, frequent full garbage collection cycles, or out-of-memory exceptions when RMI instrumentation is enabled. Enable verbose GC logging and correlate spikes with network traffic to RMI ports. Log aggregation systems should track OpenTelemetry instrumentation errors or warnings related to context propagation parsing. Network intrusion detection systems can flag unusually large RMI payloads to a given endpoint as a precursor to exploitation attempts.

Why prioritize this

Although the CVSS score of 5.3 is moderate, the combination of zero authentication requirements, low complexity, network-reachable attack surface, and availability impact warrants timely patching. Organizations with exposed RMI endpoints or deployments in untrusted network zones should treat this as high priority. Internal-only deployments with proper network segmentation can schedule patching during standard maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a medium-severity availability attack with no confidentiality or integrity impact. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates network accessibility, low attack complexity, and no privileges or user interaction required—all factors that lower the barrier to exploitation. The severity is not critical because the impact is limited to denial of service rather than data compromise or system takeover, and the vulnerability is scope-limited to deployments with RMI instrumentation enabled and exposed.

Frequently asked questions