{"data":{"id":"9432ff19-ddb5-4435-8d62-ebb15e9f77e2","title":"GHSA-fq3f-m5qm-99f5: OpenTelemetry Javaagent RMI context propagation allows resource exhaustion","summary":"OpenTelemetry Javaagent has a vulnerability in RMI context propagation (a feature that passes request information across RMI, which is a Java technology for calling functions on remote computers). An attacker who can reach an RMI endpoint can send an oversized payload that causes the Java Virtual Machine to allocate excessive memory, potentially crashing the service or making it unavailable. The vulnerability only affects systems that have RMI instrumentation enabled and the RMI endpoint exposed to the network.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-fq3f-m5qm-99f5","publishedAt":"2026-07-29T17:16:32.000Z","cveId":"CVE-2026-54712","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["io.opentelemetry.javaagent:opentelemetry-javaagent@< 2.27.0 (fixed: 2.27.0)"],"affectedVendors":[],"affectedVendorsRaw":["OpenTelemetry"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00263,"patchAvailable":true,"disclosureDate":"2026-07-29T17:16:32.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":null}}