{"id":"CVE-2026-118259","aliases":["GHSA-ccrj-gw8r-854m"],"title":"opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing","summary":"opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing","severity":"medium","cvss":5.3,"cwe":["CWE-1333"],"vendor":"opentelemetry","product":"io.opentelemetry:opentelemetry-api","ecosystem":"maven","affected":["io.opentelemetry:opentelemetry-api <= 1.66.0"],"patched":["io.opentelemetry:opentelemetry-api 1.67.0"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T21:07:41Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-ccrj-gw8r-854m","references":[{"url":"https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m"},{"url":"https://github.com/open-telemetry/opentelemetry-java/pull/8914"},{"url":"https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5"},{"url":"https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f"},{"url":"https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0"},{"url":"https://github.com/advisories/GHSA-ccrj-gw8r-854m"}],"tags":["ghsa","maven"],"ingestedAt":"2026-10-28T21:18:49.942Z","slug":"CVE-2026-118259","body":"## Overview\n\n### Summary\n\nOpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.\n\n### Impact\n\nAn unauthenticated attacker whose headers reach `W3CTraceContextPropagator.extract()` can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.\n\n### Patches\n\nUpgrade `io.opentelemetry:opentelemetry-api` to version **1.67.0** or later. [PR #8914](https://github.com/open-telemetry/opentelemetry-java/pull/8914) replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.\n\n### Workarounds\n\nIf upgrading is not possible, reject or remove oversized `tracestate` headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.\n\n## Affected packages\n\n- `io.opentelemetry:opentelemetry-api <= 1.66.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `io.opentelemetry:opentelemetry-api 1.67.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}