open-telemetry opentelemetry-java

• CVE-2026-118259 Medium 5.3 opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing 0.5%
• CVE-2026-45292 Medium 5.3 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation 1.1%