{"id":"CVE-2026-118259","kind":"vulnerability","aliases":["CVE-2026-118259","GHSA-ccrj-gw8r-854m"],"related":[],"title":"opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing","description":"### Summary\n\nOpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.\n\n### Impact\n\nAn unauthenticated attacker whose headers reach `W3CTraceContextPropagator.extract()` can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.\n\n### Patches\n\nUpgrade `io.opentelemetry:opentelemetry-api` to version **1.67.0** or later. [PR #8914](https://github.com/open-telemetry/opentelemetry-java/pull/8914) replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.\n\n### Workarounds\n\nIf upgrading is not possible, reject or remove oversized `tracestate` headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.","summary":"opentelemetry-java's W3C trace context extractor uses a regex that backtracks badly on tracestate headers with long runs of spaces or tabs and no comma. An unauthenticated attacker sending such headers can tie up request or event-loop threads and drive up CPU use.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"io.opentelemetry:opentelemetry-api","fixed":["1.67.0"],"affected":"<= 1.66.0","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-1333","java","microservices","opentelemetry","package","self-hosted"],"not_affected_if":["header-size-limits","no-incoming-trace-context"],"how_to_check":"- Check the opentelemetry-java version in the build file or dependency tree (for example `./gradlew dependencies` or `mvn dependency:tree`) and look for `opentelemetry-api` or `opentelemetry-sdk` below `1.67.0`","fix":"- Upgrade opentelemetry-java (`opentelemetry-api` and `opentelemetry-sdk`) to `1.67.0` or later\n- Limit inbound header size at the ingress or proxy as a stopgap","status":"open","published_at":"2026-10-28T19:17:30+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:36:14+00:00","updated_at":"2026-10-28T21:07:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T19:36:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade opentelemetry-java (`opentelemetry-api` and `opentelemetry-sdk`) to `1.67.0` or later\n- Limit inbound header size at the ingress or proxy as a stopgap","reach":"internet","title":"OpenTelemetry Java: tracestate header parsing lets requests burn CPU","impact":"low","summary":"opentelemetry-java's W3C trace context extractor uses a regex that backtracks badly on tracestate headers with long runs of spaces or tabs and no comma. An unauthenticated attacker sending such headers can tie up request or event-loop threads and drive up CPU use.","category":"package","nicknames":[],"who_cares":["java","opentelemetry","self-hosted","microservices"],"confidence":0.7,"needs_auth":"no","worst_case":"Request threads spin on crafted headers, causing CPU exhaustion and denial of service","analyst_note":"","how_to_check":"- Check the opentelemetry-java version in the build file or dependency tree (for example `./gradlew dependencies` or `mvn dependency:tree`) and look for `opentelemetry-api` or `opentelemetry-sdk` below `1.67.0`","needs_analyst":false,"not_affected_if":["header-size-limits","no-incoming-trace-context"],"who_is_affected":"Services written in Java that use opentelemetry-java to extract incoming W3C trace context from HTTP or event headers are exposed, since the attacker's headers reach the vulnerable parser. Teams whose ingress or proxy caps header size, or who do not extract incoming trace context, carry much less risk. The sources do not say which frameworks or default configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":3446,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118259':13A,21A '-1333':27B '-2026':12A,20A '/open-telemetry/opentelemetry-java/pull/8914)':204C '1.67.0':197C '854m':18A '8914':201C 'actual':160C 'affect':147C 'api':25A,194C 'attack':64B,128C 'backtrack':47B,107C 'bad':48B 'block':142C 'call':144C 'caus':108C,134C 'ccrj':16A 'comma':61B,124C,211C 'configur':170C 'connect':149C 'consumpt':6A,94C 'contain':114C 'context':41B,89C,232C 'cost':182C,241C 'cpu':5A,80B,93C,136C 'craft':97C,139C 'cve':11A,19A 'cwe':26B 'delimit':207C 'denial':103C 'depend':162C 'drive':78B 'elimin':186C,245C 'event':74B,157C 'event-loop':73B,156C 'excess':92C,135C 'explicit':214C 'extract':96C,151C,233C 'extractor':42B 'follow':123C 'ghsa':15A 'ghsa-ccrj-gw8r-854m':14A 'github.com':203C 'github.com/open-telemetry/opentelemetry-java/pull/8914)':202C 'gw8r':17A 'header':51B,67B,99C,113C,130C,166C,174C,228C 'header-s':165C,173C 'host':34B 'impact':125C,161C 'ingress':164C 'io.opentelemetry':22A,191C 'java':3A,28B,37B,84C 'later':199C 'lead':101C 'limit':168C,176C 'liter':210C 'long':53B,115C 'loop':75B,158C 'microservic':29B 'opentelemetri':2A,30B,36B,83C,193C 'opentelemetry':24A 'opentelemetry-api':23A,192C 'opentelemetry-java':1A,35B 'overs':226C 'packag':31B 'pars':10A,110C,141C,240C 'patch':189C 'per':180C,238C 'per-request':179C,237C 'permit':91C 'possibl':222C 'potenti':100C,146C 'pr':200C 'propag':90C 'proxi':169C 'quadrat':4A,109C 'reach':131C 'reduc':177C,235C 'regex':45B,106C,206C 'reject':223C 'remov':225C 'repeat':249C 'replac':205C 'request':71B,140C,181C,239C,250C 'risk':247C 'run':54B,116C,152C 'scan':212C 'self':33B 'self-host':32B 'send':65B 'servic':105C 'share':155C 'size':167C,175C 'space':56B,118C 'split':208C 'summari':82C 'tab':58B,120C 'thread':76B,145C,159C,172C 'tie':69B 'time':111C 'trace':40B,88C,231C 'trace-context':87C,230C 'tracest':9A,50B,98C,227C 'trim':216C 'unauthent':63B,127C 'upgrad':190C,219C 'usag':137C 'use':43B,81B 'version':196C 'vulner':188C 'w3c':8A,39B,86C 'w3ctracecontextpropagator.extract':132C 'whitespac':215C 'whose':129C 'without':121C 'workaround':217C","nicknames":[],"mitigations":[],"who_affected":"Services written in Java that use opentelemetry-java to extract incoming W3C trace context from HTTP or event headers are exposed, since the attacker's headers reach the vulnerable parser. Teams whose ingress or proxy caps header size, or who do not extract incoming trace context, carry much less risk. The sources do not say which frameworks or default configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118259","severity":null,"published_at":"2026-10-28T19:17:30+00:00","modified_at":"2026-10-28T19:17:30+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null},{"source":"ghsa","external_id":"GHSA-ccrj-gw8r-854m","url":"https://github.com/advisories/GHSA-ccrj-gw8r-854m","severity":"medium","published_at":"2026-10-28T21:07:40+00:00","modified_at":"2026-10-28T21:07:41+00:00","first_seen_at":"2026-10-28T21:07:44+00:00","fetched_at":"2026-10-28T21:12:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}