Live › vulnerability › CVE-2026-118259
Go to dashboardopentelemetry-java's W3C trace context extractor uses a regex that backtracks badly on tracestate headers with long runs of spaces or tabs and no comma. An unauthenticated attacker sending such headers can tie up request or event-loop threads and drive up CPU use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Services written in Java that use opentelemetry-java to extract incoming W3C trace context from HTTP or event headers are exposed, since the attacker's headers reach the vulnerable parser. Teams whose ingress or proxy caps header size, or who do not extract incoming trace context, carry much less risk. The sources do not say which frameworks or default configurations are affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| io.opentelemetry:opentelemetry-api | maven | <= 1.66.0 | 1.67.0 |
./gradlew dependencies or mvn dependency:tree) and look for opentelemetry-api or opentelemetry-sdk below 1.67.0opentelemetry-api and opentelemetry-sdk) to 1.67.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.
An unauthenticated attacker whose headers reach W3CTraceContextPropagator.extract() can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.
Upgrade io.opentelemetry:opentelemetry-api to version 1.67.0 or later. PR #8914 replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.
If upgrading is not possible, reject or remove oversized tracestate headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-118259")
NVD data is provided by NIST and is public domain · GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.