{"id":"CVE-2026-118259","aliases":["GHSA-ccrj-gw8r-854m"],"title":"opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\n\nOpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.\n\n### Impact\n\nAn unauthenticated attacker whose headers reach `W3CTraceContextPropagator.extract()` can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.\n\n### Patches\n\nUpgrade `io.opentelemetry:opentelemetry-api` to version **1.67.0** or later. [PR #8914](https://github.com/open-telemetry/opentelemetry-java/pull/8914) replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.\n\n### Workarounds\n\nIf upgrading is not possible, reject or remove oversized `tracestate` headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.","severity":"medium","score":5.3,"published":"2026-10-28T18:53:25.875Z","modified":"2026-10-28T21:15:04.329Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Maven","name":"io.opentelemetry:opentelemetry-api","sources":[{"name":"OSV · GHSA-ccrj-gw8r-854m","url":"https://osv.dev/vulnerability/GHSA-ccrj-gw8r-854m"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.67.0"}],"type":"ECOSYSTEM"}],"versions":["0.10.0","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.16.0","0.17.0","0.17.1","0.2.0","0.2.1","0.2.4","0.3.0","0.4.0","0.4.1","0.5.0","0.6.0","0.7.0","0.7.1","0.8.0","0.9.0","0.9.1","1.0.0","1.0.1","1.1.0","1.10.0","1.10.0-rc.1","1.10.0-rc.2","1.10.1","1.11.0","1.12.0","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.20.0","1.20.1","1.21.0","1.22.0","1.23.0","1.23.1","1.24.0","1.25.0","1.26.0","1.27.0","1.28.0","1.29.0","1.3.0","1.30.0","1.30.1","1.31.0","1.32.0","1.33.0","1.34.0","1.34.1","1.35.0","1.36.0","1.37.0","1.38.0","1.39.0","1.4.0","1.4.1","1.40.0","1.41.0","1.42.0","1.42.1","1.43.0","1.44.0","1.44.1","1.45.0","1.46.0","1.47.0","1.48.0","1.49.0","1.5.0","1.50.0","1.51.0","1.52.0","1.53.0","1.54.0","1.54.1","1.55.0","1.56.0","1.57.0","1.58.0","1.59.0","1.6.0","1.60.0","1.60.1","1.61.0","1.62.0","1.63.0","1.64.0","1.65.0","1.66.0","1.7.0","1.7.1","1.9.0","1.9.1"],"fixed":["1.67.0"]}],"sourceAffected":[],"references":["https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m","https://github.com/open-telemetry/opentelemetry-java/pull/8914","https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5","https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f","https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0","https://github.com/open-telemetry/opentelemetry-java"],"sources":[{"name":"CVE","id":"CVE-2026-118259","modified":"2026-10-28T18:53:25.875Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118259"},{"name":"OSV","id":"GHSA-ccrj-gw8r-854m","modified":"2026-10-28T21:15:04.329194019Z","url":"https://osv.dev/vulnerability/GHSA-ccrj-gw8r-854m"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3}],"cve":{"records":[{"id":"CVE-2026-118259","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-27T20:13:55.314Z","published":"2026-10-28T18:53:25.875Z","modified":"2026-10-28T18:53:25.875Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-28T18:53:25.875Z"}],"references":[{"url":"https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/open-telemetry/opentelemetry-java/pull/8914","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-1333","description":"CWE-1333: Inefficient Regular Expression Complexity","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"open-telemetry","name":"opentelemetry-java","platforms":[],"versions":[{"version":"< 1.67.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-118259"}],"remediation":[],"observedAt":"2026-10-29T15:03:18.721Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T19:35:38.098Z","attemptedAt":"2026-10-28T19:35:38.098Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T19:35:38.643Z","attemptedAt":"2026-10-28T19:35:38.643Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-28T19:35:37.686Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T19:35:37.866Z","attemptedAt":"2026-10-28T19:35:37.866Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118259","modified":"2026-10-28T19:17:30.510","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-10-28T19:35:38.098Z"}],"aiSummary":{"text":"OpenTelemetry Java's W3C trace-context propagator in versions before 1.67.0 may permit excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. An unauthenticated attacker can cause this through crafted requests. The actual impact depends on various factors, including header-size limits and threading.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:58:45.777Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118259"},{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-ccrj-gw8r-854m"}]}}