CVE-2026-118259

MediumCVSS 5.3

Published: 28/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

42th percentile - higher than 42% of all known CVEs

Summary

opentelemetry-java before 1.67.0 has a vulnerability in W3CTraceContextPropagator.extract() where regex delimiter processing can exhibit quadratic backtracking when parsing tracestate headers with long runs of spaces or tabs without a following comma. An unauthenticated attacker can block request threads and cause excessive CPU consumption.

Risk Assessment

An attacker can cause excessive CPU consumption and block request-handling threads, leading to service degradation or unavailability.

Recommendation

Update opentelemetry-java to 1.67.0. Consider limiting header sizes at the ingress/proxy layer.

Other vulnerabilities in opentelemetry-java

CVE-2026-45292Medium
The Java implementation of OpenTelemetry (opentelemetry-api and opentelemetry-extension-trace-propagators) before version 1.62.0 is vulnerable to oversized baggage processing, causing unbounded memory allocation and CPU consumption. Baggage is automatically re-injected into outgoing requests, potentially spreading the attack to downstream services.

Original NVD description (English source)

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS