GHSA-ccrj-gw8r-854m: Medium severity maven/io.opentelemetry:opentelemetry-api vulnerability
Summary
OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.
Impact
An unauthenticated attacker whose headers reach W3CTraceContextPropagator.extract() can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.
Patches
Upgrade io.opentelemetry:opentelemetry-api to version 1.67.0 or later. PR #8914 replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.
Workarounds
If upgrading is not possible, reject or remove oversized tracestate headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.opentelemetry:opentelemetry-apito a version that resolves this vulnerability.Fixed in 1.67.0 - Upgrade
Upgrade
io.opentelemetry:opentelemetry-apito a version that resolves this vulnerability.Fixed in 1.67.0Patch PR #8914 - Compensating control
If upgrading is not possible, reject or remove oversized tracestate headers before trace-context extraction.
Event History
Frequently Asked Questions
What conditions make this issue exploitable in an application?
An unauthenticated attacker can exploit it if they can send HTTP headers that reach W3CTraceContextPropagator.extract(). The crafted tracestate header contains a long run of spaces or tabs without a subsequent comma, causing quadratic parsing time.
Which deployments are most likely to see operational impact?
Impact is greater when trace-context extraction runs on a shared event-loop thread, because parsing can block that thread and affect other connections. The practical impact also depends on ingress header-size limits and proxy configuration.
Do header-size limits fully mitigate the problem?
No. Header-size limits reduce the CPU cost of an individual request, but they do not eliminate the vulnerability.
What can be done before upgrading?
Reject or remove oversized tracestate headers before trace-context extraction. This reduces the per-request parsing cost.
What version resolves the issue?
Upgrade io.opentelemetry:opentelemetry-api to version 1.67.0 or later.