com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.5, <=4.2.0), dev.vality:kotlin-service-parent-pom (>=4.0.0, <=4.0.1) +9 more potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=2.14.0, <=2.26.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =2.14.0, =3.8.5, =4.0.0, =4.0.0, =4.0.0-alpha1, =0.93.5, =0.93.5, =0.36.3, =2.1.5, =2.5.12, =3.0.0-beta-2, =3.0.0-beta-2, =3.0.0 Source cves: CVE-2026-54712 Source advisory: SNYK:JAVA-IOOPENTELEMETRYJAVAAGENT-18508013...

io.honeycomb:honeycomb-opentelemetry-javaagent (>=0.8.1, <=0.9.0) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.9.2)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent =0.8.1, =0.9...

io.honeycomb:honeycomb-opentelemetry-javaagent (0.10.0), org.hypertrace.agent:javaagent (>=1.2.3, <=1.2.6) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.11.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent 0.10.0 -...

org.apache.hbase:hbase-assembly (>=2.5.0, <=3.0.0-beta-1) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.15.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.apache.hbase:hbase-assembly =2.5.0, =3.0.0-beta-1 Sour...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.5, <=4.2.0), dev.vality:kotlin-service-parent-pom (>=4.0.0, <=4.0.1) +9 more potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=2.14.0, <=2.26.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =2.14.0, =3.8.5, =4.0.0, =4.0.0, =4.0.0-alpha1, =0.93.5, =0.93.5, =0.36.3, =2.1.5, =2.5.12, =3.0.0-beta-2, =3.0.0-beta-2, =3.0.0 Source cves: CVE-2026-54712 Source advisory: OSV:GHSA-FQ3F-M5QM-99F5...

io.honeycomb:honeycomb-opentelemetry-javaagent (>=0.5.0, <=0.6.1) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.6.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent =0.5.0, =0.6...

org.hypertrace.agent:javaagent (>=1.1.0, <=1.1.6), software.amazon.opentelemetry:aws-opentelemetry-agent (1.1.0) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.1.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.hypertrace.agent:javaagent =1.1.0, =1.1.6 -...

org.hypertrace.agent:javaagent (1.2.1) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.10.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.hypertrace.agent:javaagent 1.2.1 Source cves:...

io.github.microcks:microcks-app (>=1.9.0, <=1.10.1-fix-1), io.telicent.smart-caches.graph:docker (0.80.1) +1 more potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.32.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.github.microcks:microcks-app =1.9.0, =1.10.1-fix-1 -...

io.honeycomb:honeycomb-opentelemetry-javaagent (>=1.0.0, <=1.1.1) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.12.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent =1.0.0,...

io.honeycomb:honeycomb-opentelemetry-javaagent (>=1.4.0, <=1.4.1) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.19.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - io.honeycomb:honeycomb-opentelemetry-javaagent =1.4.0,...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.5, <=4.2.0), dev.vality:kotlin-service-parent-pom (>=4.0.0, <=4.0.1) +9 more potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=2.14.0, <=2.26.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =2.14.0, =3.8.5, =4.0.0, =4.0.0, =4.0.0-alpha1, =0.93.5, =0.93.5, =0.36.3, =2.1.5, =2.5.12, =3.0.0-beta-2, =3.0.0-beta-2, =3.0.0 Source cves: CVE-2026-54712 Source advisory: GHSA-FQ3F-M5QM-99F5...

software.amazon.opentelemetry:aws-opentelemetry-agent (0.12.1-aws.1) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (0.12.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - software.amazon.opentelemetry:aws-opentelemetry-agent...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.0, <=4.2.0), com.weibo:rill-flow-service (>=0.1.3, <=0.1.18) +164 more potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=0.12.1, <=2.26.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =0.12.1, =3.8.0, =0.1.3, =4.0.0, =4.0.0, =4.0.0-alpha1, =1.9.0, =0.0.10, =0.2.1, =0.6.2, =0.6.2, =0.80.0, =0.80.0, =0.19.0, =2.1.5, =2.5.0, =3.0.0 and more Source cves: CVE-2026-54712 Source advisory: MEND:CVE-2026-54712...

io.opentelemetry.javaagent:opentelemetry-javaagent-tooling (0.17.0-alpha), io.opentelemetry:opentelemetry-opencensus-shim (0.17.0-alpha) potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.17.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.0, <=4.1.0), com.weibo:rill-flow-service (>=0.1.3, <=0.1.18) +160 more potentially affected by CVE-2026-33701 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=0.12.1, <=2.23.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =0.12.1, =3.8.0, =0.1.3, =4.0.0-alpha1, =1.9.0, =0.0.10, =0.2.1, =0.6.2, =0.6.2, =0.80.0, =0.80.0, =0.19.0, =2.1.5, =2.5.0, =1.9.0, =2.4.0 and more Source cves: CVE-2026-33701 Source advisory: MEND:CVE-2026-33701...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.5, <=4.1.0), dev.vality:shared-resources (>=4.0.0-alpha1, <=4.0.0-alpha4) +2 more potentially affected by CVE-2026-33701 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=2.14.0, <=2.23.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =2.14.0, =3.8.5, =4.0.0-alpha1, =2.1.5, =2.5.12, =2.6.4-hadoop3 Source cves: CVE-2026-33701 Source advisory: SNYK:JAVA-IOOPENTELEMETRYJAVAAGENT-15857172...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the RMI integration. An attacker can execute arbitrary code with the privileges of the user running the instrumented JVM by sending specially crafted serialized data to a network-exposed JMX or RMI...

io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent-lettuce-5.0 (0.14.0), io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent-lettuce-5.1 (0.14.0) +3 more potentially affected by CVE-2026-33701 via io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent (0.14.0)

io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent and may be impacted: -...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.5, <=4.1.0), dev.vality:shared-resources (>=4.0.0-alpha1, <=4.0.0-alpha4) +2 more potentially affected by CVE-2026-33701 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=2.14.0, <=2.23.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =2.14.0, =3.8.5, =4.0.0-alpha1, =2.1.5, =2.5.12, =2.6.4-hadoop3 Source cves: CVE-2026-33701 Source advisory: OSV:GHSA-XW7X-H9FJ-P2C7...