Quadratic CPU use in opentelemetry-java tracestate parsing
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.
Summary
opentelemetry-java versions before 1.67.0 are affected. W3CTraceContextPropagator.extract() uses regex delimiter processing that can backtrack quadratically (CWE-1333) on tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and drive up CPU use, with impact bounded by header size limits, proxy configuration and threading.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-java | before 1.67.0 | 1.67.0 | Patch available | CNA |
| — | io.opentelemetry:opentelemetry-api (Maven) | before 1.67.0 | 1.67.0 | Patch available | GHSA-ccrj-gw8r-854m |
- opentelemetry-java Vendoropen-telemetry Affected before 1.67.0 Fixed in 1.67.0 Patch available CNA
- io.opentelemetry:opentelemetry-api (Maven) Vendor— Affected before 1.67.0 Fixed in 1.67.0 Patch available GHSA-ccrj-gw8r-854m
Remediation
Upgrade opentelemetry-java and io.opentelemetry:opentelemetry-api to version 1.67.0, the fixed version named in the source description and the Maven package listing.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA opentelemetry-java (open-telemetry) Fixed in 1.67.0
- Fix · GHSA-ccrj-gw8r-854m io.opentelemetry:opentelemetry-api (Maven) Fixed in 1.67.0 Advisory →
Timeline
- 2026-10-28 Threatist record created from CVE-2026-118259
- 2026-10-28 Alias added: GHSA-ccrj-gw8r-854m
- 2026-10-28 Fix available: Maven/io.opentelemetry:[email protected] · GHSA-ccrj-gw8r-854m
- 2026-10-28 CVSS score added · GHSA-ccrj-gw8r-854m
- 2026-10-28 Weakness changed · GHSA-ccrj-gw8r-854m
- 2026-10-28 6 new references · GHSA-ccrj-gw8r-854m
- 2026-11-02 CISA SSVC decision points changed
References
Other 6
- https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m
- https://github.com/open-telemetry/opentelemetry-java/pull/8914
- https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5
- https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f
- https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0
- https://github.com/open-telemetry/opentelemetry-java
More open-telemetry vulnerabilities
- TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
- TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
- TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
- TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
- TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
- TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
Sources
- CVE-2026-118259 · CVE Program
- CVE-2026-118259 · NVD
- FIRST EPSS
- GHSA-ccrj-gw8r-854m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences