---
id: CVE-2026-118259
aliases:
  - GHSA-ccrj-gw8r-854m
title: 'opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing'
summary: 'opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing'
severity: medium
cvss: 5.3
cwe:
  - CWE-1333
vendor: opentelemetry
product: 'io.opentelemetry:opentelemetry-api'
ecosystem: maven
affected:
  - 'io.opentelemetry:opentelemetry-api <= 1.66.0'
patched:
  - 'io.opentelemetry:opentelemetry-api 1.67.0'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T21:07:41Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-ccrj-gw8r-854m'
references:
  - url: >-
      https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m
  - url: 'https://github.com/open-telemetry/opentelemetry-java/pull/8914'
  - url: >-
      https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5
  - url: >-
      https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f
  - url: 'https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0'
  - url: 'https://github.com/advisories/GHSA-ccrj-gw8r-854m'
tags:
  - ghsa
  - maven
ingestedAt: '2026-10-28T21:18:49.942Z'
---

## Overview

### Summary

OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.

### Impact

An unauthenticated attacker whose headers reach `W3CTraceContextPropagator.extract()` can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.

### Patches

Upgrade `io.opentelemetry:opentelemetry-api` to version **1.67.0** or later. [PR #8914](https://github.com/open-telemetry/opentelemetry-java/pull/8914) replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.

### Workarounds

If upgrading is not possible, reject or remove oversized `tracestate` headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.

## Affected packages

- `io.opentelemetry:opentelemetry-api <= 1.66.0`

## Remediation

Upgrade to a patched release:

- `io.opentelemetry:opentelemetry-api 1.67.0`