Security Bulletin:Vulnerablity exposed in opentelemetry- prior to javaagent-2.28.0.jar

Summary Prior to the version - opentelemetry-javaagent-2.28.0.jar , exposed vulnerabilities in APIM. These are adressed by version upgrade. Vulnerability Details CVEID:CVE-2026-54704 DESCRIPTION: OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation...

org.hypertrace.agent:javaagent (>=0.12.2, <=1.0.2) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.0.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.hypertrace.agent:javaagent =0.12.2, =1.0.2 Source cves:...

io.telicent.smart-caches.entity-resolution:cli-canonical-index (>=0.6.2, <=0.6.4), io.telicent.smart-caches.entity-resolution:entity-resolver-api-server (>=0.6.2, <=0.6.4) +1 more potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.33.3)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.33.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: -...

io.honeycomb:honeycomb-opentelemetry-javaagent (0.8.0) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.9.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent 0.8.0 Source...

io.honeycomb:honeycomb-opentelemetry-javaagent (>=0.5.0, <=0.6.1) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.6.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent =0.5.0, =0.6...

io.honeycomb:honeycomb-opentelemetry-javaagent (0.10.0), org.hypertrace.agent:javaagent (>=1.2.3, <=1.2.6) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.11.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent 0.10.0 -...

org.hypertrace.agent:javaagent (>=1.3.0, <=1.3.11) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.24.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.hypertrace.agent:javaagent =1.3.0, =1.3.11 Source cves...

io.honeycomb:honeycomb-opentelemetry-javaagent (>=0.8.1, <=0.9.0) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.9.2)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent =0.8.1, =0.9...

software.amazon.opentelemetry:aws-opentelemetry-agent (0.17.0-aws.1) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (0.17.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - software.amazon.opentelemetry:aws-opentelemetry-agent...

org.hypertrace.agent:javaagent (1.2.2) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.10.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.hypertrace.agent:javaagent 1.2.2 Source cves:...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.5, <=4.2.0), dev.vality:kotlin-service-parent-pom (>=4.0.0, <=4.0.1) +9 more potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=2.14.0, <=2.27.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =2.14.0, =3.8.5, =4.0.0, =4.0.0, =4.0.0-alpha1, =0.93.5, =0.93.5, =0.36.3, =2.1.5, =2.5.12, =3.0.0-beta-2, =3.0.0-beta-2, =3.0.0 Source cves: CVE-2026-54704 Source advisory: SNYK:JAVA-IOOPENTELEMETRYJAVAAGENT-18508012...

io.honeycomb:honeycomb-opentelemetry-javaagent (1.4.2) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.22.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent 1.4.2 Sourc...

io.github.middleware-labs:agent-apm-java (>=0.0.10, <=0.0.18), io.honeycomb:honeycomb-opentelemetry-javaagent (0.4.0) +2 more potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.2.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.github.middleware-labs:agent-apm-java =0.0.10, =1.1.7,...

io.telicent.smart-caches:cli-debug (>=0.20.2, <=0.21.1) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.33.4)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.33.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.telicent.smart-caches:cli-debug =0.20.2, =0.21.1 Source...

org.apache.inlong.agent-common.1.11.0.inlong1.11.org.apache.inlong:agent-common (1.11.0), org.apache.inlong:agent-common (>=1.9.0, <=2.4.0) +145 more potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.28.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: -...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.5, <=4.2.0), dev.vality:kotlin-service-parent-pom (>=4.0.0, <=4.0.1) +9 more potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=2.14.0, <=2.27.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =2.14.0, =3.8.5, =4.0.0, =4.0.0, =4.0.0-alpha1, =0.93.5, =0.93.5, =0.36.3, =2.1.5, =2.5.12, =3.0.0-beta-2, =3.0.0-beta-2, =3.0.0 Source cves: CVE-2026-54704 Source advisory: GHSA-RWQX-FVQH-6WM4...

org.hypertrace.agent:javaagent (>=1.1.0, <=1.1.6), software.amazon.opentelemetry:aws-opentelemetry-agent (1.1.0) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.1.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.hypertrace.agent:javaagent =1.1.0, =1.1.6 -...

io.honeycomb:honeycomb-opentelemetry-javaagent (>=1.5.2, <=1.6.0) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.27.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent =1.5.2,...

com.weibo:rill-flow-service (>=0.1.3, <=0.1.18) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.29.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - com.weibo:rill-flow-service =0.1.3, =0.1.18 Source cves:...

org.hypertrace.agent:javaagent (1.2.1) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.10.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.hypertrace.agent:javaagent 1.2.1 Source cves:...