{"id":"CVE-2026-118259","summary":"opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing","details":"opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.","aliases":["GHSA-ccrj-gw8r-854m"],"modified":"2026-10-29T13:04:44.195213415Z","published":"2026-10-28T18:53:25.875Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118259.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1333"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118259.json"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-java/pull/8914"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0"},{"type":"ADVISORY","url":"https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118259"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-telemetry/opentelemetry-java","events":[{"introduced":"0"},{"fixed":"b4b3a1b354425c3f1411173c0e48cb24a1cba224"},{"fixed":"ba4dfea91647d1ef596975db5d7197681df3c0f5"},{"fixed":"cc4f5f22aed0d69369941cde8029e73507cf438f"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"1.67.0"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"ba4dfea91647d1ef596975db5d7197681df3c0f5"}]},{"range":[{"fixed":"cc4f5f22aed0d69369941cde8029e73507cf438f"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v1.67.0","range":[{"fixed":"b4b3a1b354425c3f1411173c0e48cb24a1cba224"}]}]}}],"versions":["v1.12.0","v1.11.0","v1.10.0","v1.10.0-rc.2","v1.10.0-rc.1","v1.9.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v0.17.0","v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118259.json","vanir_signatures":[{"source":"https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f","target":{"file":"api/all/src/test/java/io/opentelemetry/api/trace/propagation/W3CTraceContextPropagatorTest.java"},"deprecated":false,"digest":{"line_hashes":["16326002058465969924442796112491206152","293871597236056886666315776177192559935","263119666803904602823654182657560898438","264023897608771092923793707284935983213","331530263786663827646563845361312149445","229072277658619806593619219524216672621","24596351879490959764319191901809669688","139626864877114186149637871275286905543","82367847570516097329228646780483897174","123621527535894428718256549066187949047","27936824334932004736313341516689605285","322807071910972287082323322516901814684","308417956448682479633441167438340677994","68901785120786788762316010583070930721","178669512746241417146274118120429623922","296054387911813258822126496040462006589","31064209884922586236041532229934022206","85572928879964839966577970930043663743","56291942421800410314242358205323222434","311017006922038947089920918872407281122","285849932853877082673581338583382417903","301434638610118784665193909009890873913"],"threshold":0.9},"id":"CVE-2026-118259-0706835e","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f","target":{"file":"api/all/src/main/java/io/opentelemetry/api/trace/propagation/internal/W3CTraceContextEncoding.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["73973971571203461763227272002280472892","330935183812403726711486328107069620034","194251953648874548532527019098883456308","278891078915889129341364396728680808815","202947123693402591925761043524107287695","26336492877651697004116906036729064629","238990758998699353539108943937530692271","39984408564853971566192360143122911742","87760587081436227836443310820092446769","26088769597598495387896777025223525750","162814913887862156263074770234697415796","216435300340979328878871726097549209437","192508918245784418343020109441904988202","206401906396287555434101652265123785696","156673387093708438303500203647060162048","58305697080176242565612330835353069450","48240656715197952550693013661741659595","330257748395722578694003825247788314197","190468779528788876963179456199334464790","327868924441651395958206095688082487339","162318838226738169702082730289687222324","335692367201240394199704436359762259746","255759416580182997074300960229952140783","298591768643335738268336366531930235392","70678314070107630147077711948717927283","271796961128987053232530002521592775215","218758071137523163345055492830557879185","167769795955382015400096480031000649726"]},"id":"CVE-2026-118259-12b5b104"},{"digest":{"function_hash":"98104385040002378251345395751561971059","length":685},"id":"CVE-2026-118259-1d036987","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5","target":{"file":"api/all/src/main/java/io/opentelemetry/api/trace/propagation/internal/W3CTraceContextEncoding.java","function":"decodeTraceState"},"deprecated":false},{"source":"https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5","target":{"file":"api/all/src/test/java/io/opentelemetry/api/trace/propagation/W3CTraceContextPropagatorTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["16326002058465969924442796112491206152","293871597236056886666315776177192559935","263119666803904602823654182657560898438","264023897608771092923793707284935983213","331530263786663827646563845361312149445","229072277658619806593619219524216672621","24596351879490959764319191901809669688","139626864877114186149637871275286905543","82367847570516097329228646780483897174","123621527535894428718256549066187949047","27936824334932004736313341516689605285","322807071910972287082323322516901814684","308417956448682479633441167438340677994","68901785120786788762316010583070930721","178669512746241417146274118120429623922","296054387911813258822126496040462006589","31064209884922586236041532229934022206","85572928879964839966577970930043663743","56291942421800410314242358205323222434","311017006922038947089920918872407281122","285849932853877082673581338583382417903","301434638610118784665193909009890873913"]},"id":"CVE-2026-118259-6fd1a015","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f","target":{"file":"api/all/src/main/java/io/opentelemetry/api/trace/propagation/internal/W3CTraceContextEncoding.java","function":"decodeTraceState"},"deprecated":false,"digest":{"function_hash":"98104385040002378251345395751561971059","length":685},"id":"CVE-2026-118259-9a8af24e","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["73973971571203461763227272002280472892","330935183812403726711486328107069620034","194251953648874548532527019098883456308","278891078915889129341364396728680808815","202947123693402591925761043524107287695","26336492877651697004116906036729064629","238990758998699353539108943937530692271","39984408564853971566192360143122911742","87760587081436227836443310820092446769","26088769597598495387896777025223525750","162814913887862156263074770234697415796","216435300340979328878871726097549209437","192508918245784418343020109441904988202","206401906396287555434101652265123785696","156673387093708438303500203647060162048","58305697080176242565612330835353069450","48240656715197952550693013661741659595","330257748395722578694003825247788314197","190468779528788876963179456199334464790","327868924441651395958206095688082487339","162318838226738169702082730289687222324","335692367201240394199704436359762259746","255759416580182997074300960229952140783","298591768643335738268336366531930235392","70678314070107630147077711948717927283","271796961128987053232530002521592775215","218758071137523163345055492830557879185","167769795955382015400096480031000649726"],"threshold":0.9},"id":"CVE-2026-118259-a4abfe78","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5","target":{"file":"api/all/src/main/java/io/opentelemetry/api/trace/propagation/internal/W3CTraceContextEncoding.java"},"deprecated":false}],"vanir_signatures_modified":"2026-10-29T13:04:44Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}