CVE-2026-118259

MEDIUM 5.3

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.

CWE	CWE-1333
Vendor	open-telemetry
Product	opentelemetry-java
Published	Oct 28, 2026

Stay Ahead of the Next One

Get instant alerts for open-telemetry opentelemetry-java

Be the first to know when new medium vulnerabilities affecting open-telemetry opentelemetry-java are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

open-telemetry / opentelemetry-java

< 1.67.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m github.com: https://github.com/open-telemetry/opentelemetry-java/pull/8914 github.com: https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5 github.com: https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f github.com: https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0