OpenTelemetry Java Instrumentation versions before 2.27.0 contain a flaw in the RMI context propagation mechanism. The payload reader limits the number of context entries but ignores the aggregate size of the strings within those entries. A malicious client can send an RMI request with an oversized allocate memory proportional to the lead to a crash or hang, effectively denying service to the entire Java application (CWE‑400).

Only deployments that enable OpenTelemetry’s RMI endpoint over the network are vulnerable. The issue does not affect installations where RMI instrumentation is disabled or where the RMI service is restricted to trusted sources. Applications using OpenTelemetry Java Instrumentation 2.27.0 or later are not impacted.

With a CVSS v3.1 score of 5.3, the vulnerability is medium severity. An EPSS score of less than 1% indicates a very low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Exploitation requires network access to a reachable RMI endpoint and the ability to inject a specially crafted, oversized payload. No elevated privileges are needed beyond this connectivity, of the JVM balancing the application.