Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

io.opentelemetry.javaagent:opentelemetry-javaagent

3 known vulnerabilities (1 critical, 2 medium), with the versions each affects and the releases that fix them.

Latest release
2.33.1 (Oct 27, 2026): no advisory affects it
Newest unaffected release
2.33.1 (Oct 27, 2026), the latest release
Advisories
3 · 1 critical, 2 medium
Dependents
0
Releases
117 since 0.12.0 (Dec 9, 2020)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-54712Medium 5.3

    OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

    Affected: fixed in 2.27.0.

    Fixed in 2.27.0 (released Apr 21, 2026, 71 days before disclosure).

    The latest release, 2.33.1, is not affected.

  • CVE-2026-54704Medium 6.5

    OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

    Affected: fixed in 2.28.0-alpha.

    Fixed in 2.28.0 (released May 19, 2026, 43 days before disclosure, the advisory names 2.28.0-alpha, which was never published).

    The latest release, 2.33.1, is not affected.

  • CVE-2026-33701Critical 9.3

    OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

    Affected: fixed in 2.26.1.

    Fixed in 2.26.1 (released Mar 23, 2026, 4 days before disclosure).

    The latest release, 2.33.1, is not affected.