GHSA-ccrj-gw8r-854m

Suggest an improvement
Source
https://github.com/advisories/GHSA-ccrj-gw8r-854m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-ccrj-gw8r-854m/GHSA-ccrj-gw8r-854m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-ccrj-gw8r-854m
Aliases
  • CVE-2026-118259
Published
2026-10-28T21:07:40Z
Modified
2026-10-28T21:15:04Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
Details

Summary

OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.

Impact

An unauthenticated attacker whose headers reach W3CTraceContextPropagator.extract() can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.

Patches

Upgrade io.opentelemetry:opentelemetry-api to version 1.67.0 or later. PR #8914 replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.

Workarounds

If upgrading is not possible, reject or remove oversized tracestate headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.

Database specific 
{
    "cwe_ids":  [
        "CWE-1333"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-28T21:07:40Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Maven / io.opentelemetry:opentelemetry-api

Package

Name
io.opentelemetry:opentelemetry-api
View open source insights on deps.dev
Purl
pkg:maven/io.opentelemetry/opentelemetry-api

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.67.0

Affected versions

0.*
0.2.0
0.2.1
0.2.4
0.3.0
0.4.0
0.4.1
0.5.0
0.6.0
0.7.0
0.7.1
0.8.0
0.9.0
0.9.1
0.10.0
0.11.0
0.12.0
0.13.0
0.13.1
0.14.0
0.14.1
0.15.0
0.16.0
0.17.0
0.17.1
1.*
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.7.0
1.7.1
1.9.0
1.9.1
1.10.0-rc.1
1.10.0-rc.2
1.10.0
1.10.1
1.11.0
1.12.0
1.13.0
1.14.0
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.20.0
1.20.1
1.21.0
1.22.0
1.23.0
1.23.1
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.29.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.40.0
1.41.0
1.42.0
1.42.1
1.43.0
1.44.0
1.44.1
1.45.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.54.1
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.60.1
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0

Database specific

last_known_affected_version_range 
"<= 1.66.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-ccrj-gw8r-854m/GHSA-ccrj-gw8r-854m.json"