Deserialization Of Untrusted Data

🗓️ 28 Mar 2026 05:14:41Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 4 Views

Deserialization of untrusted data in OpenTelemetry Java agent enables remote code execution via unfiltered endpoint.

Reporter	Title	Published	Views	Family All 19
IBM Security Bulletins	Security Bulletin: Cross-site scripting, authentication bypass by spoofing, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	18 May 202616:41	–	ibm
ATTACKERKB	CVE-2026-33701	27 Mar 202600:01	–	attackerkb
Circl	CVE-2026-33701	27 Mar 202602:50	–	circl
CNNVD	OpenTelemetry Instrumentation for Java 代码问题漏洞	27 Mar 202600:00	–	cnnvd
CVE	CVE-2026-33701	27 Mar 202600:01	–	cve
Cvelist	CVE-2026-33701 OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution	27 Mar 202600:01	–	cvelist
Elastic	Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)	30 Mar 202614:17	–	elastic
GithubExploit	Exploit for Deserialization of Untrusted Data in Linuxfoundation Opentelemetry_Instrumentation_For_Java	4 Apr 202611:14	–	githubexploit
Github Security Blog	OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution	25 Mar 202621:27	–	github
NVD	CVE-2026-33701	27 Mar 202601:16	–	nvd

Vulners

Node

opentelemetry opentelemetry-javaagentRange0.9.0–2.26.0java

opentelemetry opentelemetry-javaagentMatch0.12.0java

opentelemetry opentelemetry-javaagentMatch0.12.1java

opentelemetry opentelemetry-javaagentMatch0.13.0java

opentelemetry opentelemetry-javaagentMatch0.13.1java

opentelemetry opentelemetry-javaagentMatch0.14.0java

opentelemetry opentelemetry-javaagentMatch0.15.0java

opentelemetry opentelemetry-javaagentMatch0.15.1java

opentelemetry opentelemetry-javaagentMatch0.16.0java

opentelemetry opentelemetry-javaagentMatch0.16.1java

opentelemetry opentelemetry-javaagentMatch0.17.0java

opentelemetry opentelemetry-javaagentMatch1.0.0java

opentelemetry opentelemetry-javaagentMatch1.0.1java

opentelemetry opentelemetry-javaagentMatch1.1.0java

opentelemetry opentelemetry-javaagentMatch1.10.0java

opentelemetry opentelemetry-javaagentMatch1.10.1java

opentelemetry opentelemetry-javaagentMatch1.11.0java

opentelemetry opentelemetry-javaagentMatch1.11.1java

opentelemetry opentelemetry-javaagentMatch1.12.0java

opentelemetry opentelemetry-javaagentMatch1.12.1java

opentelemetry opentelemetry-javaagentMatch1.13.0java

opentelemetry opentelemetry-javaagentMatch1.13.1java

opentelemetry opentelemetry-javaagentMatch1.14.0java

opentelemetry opentelemetry-javaagentMatch1.15.0java

opentelemetry opentelemetry-javaagentMatch1.16.0java

opentelemetry opentelemetry-javaagentMatch1.17.0java

opentelemetry opentelemetry-javaagentMatch1.18.0java

opentelemetry opentelemetry-javaagentMatch1.19.0java

opentelemetry opentelemetry-javaagentMatch1.19.1java

opentelemetry opentelemetry-javaagentMatch1.19.2java

opentelemetry opentelemetry-javaagentMatch1.2.0java

opentelemetry opentelemetry-javaagentMatch1.20.0java

opentelemetry opentelemetry-javaagentMatch1.20.1java

opentelemetry opentelemetry-javaagentMatch1.20.2java

opentelemetry opentelemetry-javaagentMatch1.21.0java

opentelemetry opentelemetry-javaagentMatch1.22.0java

opentelemetry opentelemetry-javaagentMatch1.22.1java

opentelemetry opentelemetry-javaagentMatch1.23.0java

opentelemetry opentelemetry-javaagentMatch1.24.0java

opentelemetry opentelemetry-javaagentMatch1.25.0java

opentelemetry opentelemetry-javaagentMatch1.25.1java

opentelemetry opentelemetry-javaagentMatch1.26.0java

opentelemetry opentelemetry-javaagentMatch1.27.0java

opentelemetry opentelemetry-javaagentMatch1.28.0java

opentelemetry opentelemetry-javaagentMatch1.29.0java

opentelemetry opentelemetry-javaagentMatch1.3.0java

opentelemetry opentelemetry-javaagentMatch1.3.1java

opentelemetry opentelemetry-javaagentMatch1.30.0java

opentelemetry opentelemetry-javaagentMatch1.31.0java

opentelemetry opentelemetry-javaagentMatch1.32.0java

opentelemetry opentelemetry-javaagentMatch1.32.1java

opentelemetry opentelemetry-javaagentMatch1.33.0java

opentelemetry opentelemetry-javaagentMatch1.33.1java

opentelemetry opentelemetry-javaagentMatch1.33.2java

opentelemetry opentelemetry-javaagentMatch1.33.3java

opentelemetry opentelemetry-javaagentMatch1.33.4java

opentelemetry opentelemetry-javaagentMatch1.33.5java

opentelemetry opentelemetry-javaagentMatch1.33.6java

opentelemetry opentelemetry-javaagentMatch1.4.0java

opentelemetry opentelemetry-javaagentMatch1.4.1java

opentelemetry opentelemetry-javaagentMatch1.5.0java

opentelemetry opentelemetry-javaagentMatch1.5.1java

opentelemetry opentelemetry-javaagentMatch1.5.2java

opentelemetry opentelemetry-javaagentMatch1.5.3java

opentelemetry opentelemetry-javaagentMatch1.6.0java

opentelemetry opentelemetry-javaagentMatch1.6.1java

opentelemetry opentelemetry-javaagentMatch1.6.2java

opentelemetry opentelemetry-javaagentMatch1.7.0java

opentelemetry opentelemetry-javaagentMatch1.7.1java

opentelemetry opentelemetry-javaagentMatch1.7.2java

opentelemetry opentelemetry-javaagentMatch1.8.0java

opentelemetry opentelemetry-javaagentMatch1.9.0java

opentelemetry opentelemetry-javaagentMatch1.9.1java

opentelemetry opentelemetry-javaagentMatch1.9.2java

opentelemetry opentelemetry-javaagentMatch2.0.0java

opentelemetry opentelemetry-javaagentMatch2.1.0java

opentelemetry opentelemetry-javaagentMatch2.10.0java

opentelemetry opentelemetry-javaagentMatch2.11.0java

opentelemetry opentelemetry-javaagentMatch2.12.0java

opentelemetry opentelemetry-javaagentMatch2.13.0java

opentelemetry opentelemetry-javaagentMatch2.13.1java

opentelemetry opentelemetry-javaagentMatch2.13.2java

opentelemetry opentelemetry-javaagentMatch2.13.3java

opentelemetry opentelemetry-javaagentMatch2.14.0java

opentelemetry opentelemetry-javaagentMatch2.15.0java

opentelemetry opentelemetry-javaagentMatch2.16.0java

opentelemetry opentelemetry-javaagentMatch2.17.0java

opentelemetry opentelemetry-javaagentMatch2.17.1java

opentelemetry opentelemetry-javaagentMatch2.18.0java

opentelemetry opentelemetry-javaagentMatch2.18.1java

opentelemetry opentelemetry-javaagentMatch2.19.0java

opentelemetry opentelemetry-javaagentMatch2.2.0java

opentelemetry opentelemetry-javaagentMatch2.20.0java

opentelemetry opentelemetry-javaagentMatch2.20.1java

opentelemetry opentelemetry-javaagentMatch2.21.0java

opentelemetry opentelemetry-javaagentMatch2.22.0java

opentelemetry opentelemetry-javaagentMatch2.23.0java

opentelemetry opentelemetry-javaagentMatch2.24.0java

opentelemetry opentelemetry-javaagentMatch2.25.0java

opentelemetry opentelemetry-javaagentMatch2.3.0java

opentelemetry opentelemetry-javaagentMatch2.4.0java

opentelemetry opentelemetry-javaagentMatch2.5.0java

opentelemetry opentelemetry-javaagentMatch2.6.0java

opentelemetry opentelemetry-javaagentMatch2.7.0java

opentelemetry opentelemetry-javaagentMatch2.8.0java

opentelemetry opentelemetry-javaagentMatch2.9.0java

Source	Link
github	www.github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-xw7x-h9fj-p2c7
github	www.github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.26.1
github	www.github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197

09 May 2026 05:13Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.19.8

CVSS 49.3

EPSS0.00214

SSVC