24 matches found
CLEANSTART-2026-HN10923 opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API
CVE-2026-45292 affects multiple packages. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. See references for individual vulnerability details...
CLEANSTART-2026-IX22317 opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API
Security vulnerability affects the sonarqube package. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API...
CVE-2026-33701-Unsafe-Deserialization-in-OpenTelemetry-Java-Agent-RMI-Instrumentation
CVE-2026-33701 — Небезопасная десериализация в RMI-инструментации Java-агента OpenTelemetry Серьёзность: Критическая CVSS v4.0: 9.3 Затронутые версии: opentelemetry-javaagent 2.26.1 Исправлено в: 2.26.1 выпущено 23 марта 2026 года Обзор OpenTelemetry — пожалуй, самый широко используемый фреймворк...
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-56339 DESCRIPTION: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker...
ROOT-APP-MAVEN-CVE-2026-33701 CVE-2026-33701 in io.opentelemetry.javaagent:opentelemetry-javaagent - Patched by Root
Root has patched CVE-2026-33701 in the io.opentelemetry.javaagent:opentelemetry-javaagent package for Root:Maven. Multiple fixed versions available...
Security Bulletin: Vulnerability in opentelemetry-java affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in opentelemetry-java has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...
Vulnerabilities hidden within Keycloak
Red Hat has addressed several vulnerabilities in Keycloak. The vulnerability with CVE-2026-18963 allows an unauthorized external attacker to force a password reset for any user account, thereby enabling them to take control of that account. This vulnerability exposes the email verification proces...
EUVD-2026-41152
OpenTelemetry Javaagent RMI context propagation allows resource exhaustion...
PT-2026-54845
Name of the Vulnerable Software and Affected Versions OpenTelemetry Java Instrumentation versions prior to 2.27.0 Description An issue exists in the RMI context propagation payload reader where the number of context entries is limited, but the aggregate size of the strings read from the stream is...
CVE-2026-54712: Uncontrolled Resource Consumption
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the...
CVE-2026-54704: Insertion of Sensitive Information into Log File
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text...
CVE-2026-45292
The opentelemetry-java Java implementation (specifically opentelemetry-api and opentelemetry-extension-trace-propagators ) is vulnerable to unbounded memory allocation and CPU consumption due to parsing oversized baggage prior to version 1.62.0 . Because baggage is automatically re-injected into ...
CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...
CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...
CVE-2026-45292: Allocation of Resources Without Limits or Throttling
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...
GHSA-RCGG-9C38-7XPX OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
Overview A vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, t...
PT-2026-41161
Name of the Vulnerable Software and Affected Versions opentelemetry-java versions prior to 1.62.0 Description A flaw in the baggage propagation implementation within opentelemetry-api and opentelemetry-extension-trace-propagators allows for unbounded memory allocation and CPU consumption when...
CVE-2026-33701: Deserialization of Untrusted Data
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and...
PT-2026-30534
In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. Al...