Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M

CVE-2026-118259opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Medium 5.3

In plain English

A medium-severity regular-expression denial of service in opentelemetry-java from open-telemetry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 57.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.opentelemetry:opentelemetry-api	1.67.0	GHSA-ccrj-gw8r-854m

Affected products (as reported)

Vendor	Product	Versions
open-telemetry	opentelemetry-java	< 1.67.0

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-java/pull/8914 x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5 x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0 x_refsource_MISC