Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118259— opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Quick assessment

Affected
open-telemetry opentelemetry-java
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenTelemetry Java 是 OpenTelemetry 的 Java 实现，包含用于记录遥测数据的 API 以及用于管理 API 所记录遥测数据的 SDK。在 1.67.0 版本之前，W3CTraceContextPropagator.extract() 方法在解析 tracestate 头部时使用了基于正则表达式的分隔符处理机制；当该头部包含长串的连续空格或制表符且后未跟随逗号时，可能引发二次回溯（quadratic backtracking）。未经身份验证的攻击者若能使此类恶意构造的头部到达提取逻

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
open-telemetry opentelemetry-java < 1.67.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118259

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
Source: CVE Program / CVE List V5
Vulnerability Description
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
open-telemetry opentelemetry-java < 1.67.0 -

II. Public POCs for CVE-2026-118259

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118259

请登录查看更多情报信息。

Other References for CVE-2026-118259 (5)

IV. Related Vulnerabilities

Same product: opentelemetry-java
Same vendor: open-telemetry
Same weakness: CWE-1333