opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
Impact
OpenTelemetry Java's W3C trace-context propagator in versions before 1.67.0 may permit excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. An unauthenticated attacker can cause this through crafted requests. The actual impact depends on various factors, including header-size limits and threading.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 1.67.0Ecosystem versions | 1.67.0 |
Version evidence: OSV · GHSA-ccrj-gw8r-854m
View original version evidence (105 explicit versions)
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
open-telemetry · GitHub_M
opentelemetry-java
1 range
open-telemetry · GitHub_M
opentelemetry-java
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 1.67.0
Other versions: unknown
Original source description
Summary
OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.
Impact
An unauthenticated attacker whose headers reach W3CTraceContextPropagator.extract() can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.
Patches
Upgrade io.opentelemetry:opentelemetry-api to version 1.67.0 or later. PR #8914 replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.
Workarounds
If upgrading is not possible, reject or remove oversized tracestate headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-118259View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.