{"id":"GHSA-ccrj-gw8r-854m","summary":"opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing","details":"### Summary\n\nOpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.\n\n### Impact\n\nAn unauthenticated attacker whose headers reach `W3CTraceContextPropagator.extract()` can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.\n\n### Patches\n\nUpgrade `io.opentelemetry:opentelemetry-api` to version **1.67.0** or later. [PR #8914](https://github.com/open-telemetry/opentelemetry-java/pull/8914) replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.\n\n### Workarounds\n\nIf upgrading is not possible, reject or remove oversized `tracestate` headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.","aliases":["CVE-2026-118259"],"modified":"2026-10-28T21:15:04.329194019Z","published":"2026-10-28T21:07:40Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-10-28T21:07:40Z","nvd_published_at":null,"cwe_ids":["CWE-1333"]},"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-java/pull/8914"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f"},{"type":"PACKAGE","url":"https://github.com/open-telemetry/opentelemetry-java"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0"}],"affected":[{"package":{"name":"io.opentelemetry:opentelemetry-api","ecosystem":"Maven","purl":"pkg:maven/io.opentelemetry/opentelemetry-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.67.0"}]}],"versions":["0.10.0","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.16.0","0.17.0","0.17.1","0.2.0","0.2.1","0.2.4","0.3.0","0.4.0","0.4.1","0.5.0","0.6.0","0.7.0","0.7.1","0.8.0","0.9.0","0.9.1","1.0.0","1.0.1","1.1.0","1.10.0","1.10.0-rc.1","1.10.0-rc.2","1.10.1","1.11.0","1.12.0","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.20.0","1.20.1","1.21.0","1.22.0","1.23.0","1.23.1","1.24.0","1.25.0","1.26.0","1.27.0","1.28.0","1.29.0","1.3.0","1.30.0","1.30.1","1.31.0","1.32.0","1.33.0","1.34.0","1.34.1","1.35.0","1.36.0","1.37.0","1.38.0","1.39.0","1.4.0","1.4.1","1.40.0","1.41.0","1.42.0","1.42.1","1.43.0","1.44.0","1.44.1","1.45.0","1.46.0","1.47.0","1.48.0","1.49.0","1.5.0","1.50.0","1.51.0","1.52.0","1.53.0","1.54.0","1.54.1","1.55.0","1.56.0","1.57.0","1.58.0","1.59.0","1.6.0","1.60.0","1.60.1","1.61.0","1.62.0","1.63.0","1.64.0","1.65.0","1.66.0","1.7.0","1.7.1","1.9.0","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-ccrj-gw8r-854m/GHSA-ccrj-gw8r-854m.json","last_known_affected_version_range":"\u003c= 1.66.0"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}