opentelemetry-java-instrumentation vulnerabilities

Product

opentelemetry-java-instrumentation

by open-telemetry · last CVE Jul 1, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 1High 1Medium 2Low 0

Severity

Exploitation

Watch

Add opentelemetry-java-instrumentation to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-33701	9.8	1%	Mar 27	OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution Affected: < 2.26.1
CVE-2026-54712	7.5	0%	Jul 1	OpenTelemetry Javaagent RMI context propagation allows resource exhaustion Affected: < 2.27.0
CVE-2026-54704	6.5	0%	Jul 1	OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords Affected: < 2.28.0
CVE-2023-39951	6.5	1%	Aug 8	Instrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing that content to the telemetry backend Affected: < 1.28.0