CVE-2026-118259: opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
OpenTelemetry Java’s W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.
References
- github.com/advisories/GHSA-ccrj-gw8r-854m
- github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5
- github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f
- github.com/open-telemetry/opentelemetry-java/pull/8914
- github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0
- github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m
- nvd.nist.gov/vuln/detail/CVE-2026-118259
Code Behaviors & Features
Detect and mitigate CVE-2026-118259 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →