CVE-2026-118259: opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opentelemetry-javato a version that resolves this vulnerability.Fixed in 1.67.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using opentelemetry-java versions before 1.67.0 are exposed when attacker-controlled request headers reach W3CTraceContextPropagator.extract(). The practical impact depends on ingress header-size limits, proxy configuration, and available request or event-loop threads.
What does an attacker need to send to trigger the CPU consumption?
An unauthenticated attacker needs to supply a tracestate header containing a long run of spaces or tabs with no following comma, and have that header processed by extraction. Repeated requests can block request or event-loop threads and consume excessive CPU.
What can be done if upgrading is not immediately possible?
Limit the size of inbound headers and use proxy or ingress configuration to prevent oversized or malformed tracestate headers from reaching the application. Threading configuration also bounds the practical impact of repeated requests.
How can I determine whether a deployment is affected?
Check whether the application uses opentelemetry-java earlier than 1.67.0 and whether inbound headers can reach W3CTraceContextPropagator.extract(). Systems that accept externally controlled tracestate headers are the relevant exposure path.