Skip to content
Open-telemetry Opentelemetry-java vulnerabilities
-
open-telemetry opentelemetry-java
opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
CVE-2026-118259
Fix available
5.3 Medium
-
linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation +1 more
OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
CVE-2026-54712
Fix available
5.3 Medium
-
linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation +1 more
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
CVE-2026-54704
Fix available
6.5 Medium
-
io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 more
opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation
CVE-2026-45292
Fix available
5.3 Medium
-
linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation, red hat jboss enterprise application platform 8 +1 more +3 more
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
CVE-2026-33701
Public exploitFix available
9.3 Critical
-
linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation +1 more
Instrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing that content to the telemetry backend
CVE-2023-39951
6.5 Medium