CVE-2026-118259

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-118259
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118259.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-118259
Aliases
Downstream
Published
2026-10-28T18:53:25Z
Modified
2026-10-29T13:04:44Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
Details

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1333"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118259.json"
}
References

Affected packages

Git / github.com/open-telemetry/opentelemetry-java

Affected ranges

Type
GIT
Repo
https://github.com/open-telemetry/opentelemetry-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b4b3a1b354425c3f1411173c0e48cb24a1cba224
Fixed
ba4dfea91647d1ef596975db5d7197681df3c0f5
Fixed
cc4f5f22aed0d69369941cde8029e73507cf438f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.67.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "ba4dfea91647d1ef596975db5d7197681df3c0f5"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "cc4f5f22aed0d69369941cde8029e73507cf438f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.67.0",
            "range":  [
                {
                    "fixed":  "b4b3a1b354425c3f1411173c0e48cb24a1cba224"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.10.0-rc.1
v1.10.0-rc.2
v1.11.0
v1.12.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118259.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "16326002058465969924442796112491206152",
                "293871597236056886666315776177192559935",
                "263119666803904602823654182657560898438",
                "264023897608771092923793707284935983213",
                "331530263786663827646563845361312149445",
                "229072277658619806593619219524216672621",
                "24596351879490959764319191901809669688",
                "139626864877114186149637871275286905543",
                "82367847570516097329228646780483897174",
                "123621527535894428718256549066187949047",
                "27936824334932004736313341516689605285",
                "322807071910972287082323322516901814684",
                "308417956448682479633441167438340677994",
                "68901785120786788762316010583070930721",
                "178669512746241417146274118120429623922",
                "296054387911813258822126496040462006589",
                "31064209884922586236041532229934022206",
                "85572928879964839966577970930043663743",
                "56291942421800410314242358205323222434",
                "311017006922038947089920918872407281122",
                "285849932853877082673581338583382417903",
                "301434638610118784665193909009890873913"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-118259-0706835e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f",
        "target":  {
            "file":  "api/all/src/test/java/io/opentelemetry/api/trace/propagation/W3CTraceContextPropagatorTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "73973971571203461763227272002280472892",
                "330935183812403726711486328107069620034",
                "194251953648874548532527019098883456308",
                "278891078915889129341364396728680808815",
                "202947123693402591925761043524107287695",
                "26336492877651697004116906036729064629",
                "238990758998699353539108943937530692271",
                "39984408564853971566192360143122911742",
                "87760587081436227836443310820092446769",
                "26088769597598495387896777025223525750",
                "162814913887862156263074770234697415796",
                "216435300340979328878871726097549209437",
                "192508918245784418343020109441904988202",
                "206401906396287555434101652265123785696",
                "156673387093708438303500203647060162048",
                "58305697080176242565612330835353069450",
                "48240656715197952550693013661741659595",
                "330257748395722578694003825247788314197",
                "190468779528788876963179456199334464790",
                "327868924441651395958206095688082487339",
                "162318838226738169702082730289687222324",
                "335692367201240394199704436359762259746",
                "255759416580182997074300960229952140783",
                "298591768643335738268336366531930235392",
                "70678314070107630147077711948717927283",
                "271796961128987053232530002521592775215",
                "218758071137523163345055492830557879185",
                "167769795955382015400096480031000649726"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-118259-12b5b104",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f",
        "target":  {
            "file":  "api/all/src/main/java/io/opentelemetry/api/trace/propagation/internal/W3CTraceContextEncoding.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "98104385040002378251345395751561971059",
            "length":  685
        },
        "id":  "CVE-2026-118259-1d036987",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5",
        "target":  {
            "file":  "api/all/src/main/java/io/opentelemetry/api/trace/propagation/internal/W3CTraceContextEncoding.java",
            "function":  "decodeTraceState"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "16326002058465969924442796112491206152",
                "293871597236056886666315776177192559935",
                "263119666803904602823654182657560898438",
                "264023897608771092923793707284935983213",
                "331530263786663827646563845361312149445",
                "229072277658619806593619219524216672621",
                "24596351879490959764319191901809669688",
                "139626864877114186149637871275286905543",
                "82367847570516097329228646780483897174",
                "123621527535894428718256549066187949047",
                "27936824334932004736313341516689605285",
                "322807071910972287082323322516901814684",
                "308417956448682479633441167438340677994",
                "68901785120786788762316010583070930721",
                "178669512746241417146274118120429623922",
                "296054387911813258822126496040462006589",
                "31064209884922586236041532229934022206",
                "85572928879964839966577970930043663743",
                "56291942421800410314242358205323222434",
                "311017006922038947089920918872407281122",
                "285849932853877082673581338583382417903",
                "301434638610118784665193909009890873913"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-118259-6fd1a015",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5",
        "target":  {
            "file":  "api/all/src/test/java/io/opentelemetry/api/trace/propagation/W3CTraceContextPropagatorTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "98104385040002378251345395751561971059",
            "length":  685
        },
        "id":  "CVE-2026-118259-9a8af24e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f",
        "target":  {
            "file":  "api/all/src/main/java/io/opentelemetry/api/trace/propagation/internal/W3CTraceContextEncoding.java",
            "function":  "decodeTraceState"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "73973971571203461763227272002280472892",
                "330935183812403726711486328107069620034",
                "194251953648874548532527019098883456308",
                "278891078915889129341364396728680808815",
                "202947123693402591925761043524107287695",
                "26336492877651697004116906036729064629",
                "238990758998699353539108943937530692271",
                "39984408564853971566192360143122911742",
                "87760587081436227836443310820092446769",
                "26088769597598495387896777025223525750",
                "162814913887862156263074770234697415796",
                "216435300340979328878871726097549209437",
                "192508918245784418343020109441904988202",
                "206401906396287555434101652265123785696",
                "156673387093708438303500203647060162048",
                "58305697080176242565612330835353069450",
                "48240656715197952550693013661741659595",
                "330257748395722578694003825247788314197",
                "190468779528788876963179456199334464790",
                "327868924441651395958206095688082487339",
                "162318838226738169702082730289687222324",
                "335692367201240394199704436359762259746",
                "255759416580182997074300960229952140783",
                "298591768643335738268336366531930235392",
                "70678314070107630147077711948717927283",
                "271796961128987053232530002521592775215",
                "218758071137523163345055492830557879185",
                "167769795955382015400096480031000649726"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-118259-a4abfe78",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5",
        "target":  {
            "file":  "api/all/src/main/java/io/opentelemetry/api/trace/propagation/internal/W3CTraceContextEncoding.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-29T13:04:44Z"