Cloudanix VulnDB

CVE-2026-118259

Medium · 5.3

CVSS

5.3

EPSS

0.5%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Java OpenTelemetry code reads certain trace headers lets attackers send specially crafted requests that slow down or stall the service by wasting processing power.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Quadratic backtracking in W3CTraceContextPropagator.extract() regex processing of tracestate headers containing long runs of spaces or tabs without commas leads to excessive CPU consumption and thread blocking during header extraction.

Why it matters to the business

Service degradation or outages from thread exhaustion and high CPU usage on any system ingesting OpenTelemetry traces, with impact limited by header size and proxy settings; requires prompt upgrade given the recent publication.

How an attack unfolds

An unauthenticated remote attacker crafts HTTP or gRPC requests containing specially formatted tracestate headers with repeated whitespace runs, causing the extract() method to consume disproportionate CPU and block request threads on each invocation.

How to fix it

Upgrade opentelemetry-java to version 1.67.0 or later; ensure all downstream applications and libraries using the SDK are rebuilt against the fixed release.

How to confirm the fix worked

Confirm the running SDK version reports 1.67.0 or higher; test header parsing with crafted tracestate inputs to verify absence of excessive CPU usage; review dependency trees for any older transitive inclusions.

Typical attack path

  1. Identify an endpoint that processes incoming traces or spans via OpenTelemetry Java SDK
  2. Craft requests with oversized tracestate headers containing repeated spaces or tabs without commas
  3. Send repeated requests to trigger quadratic backtracking in header parsing
  4. Observe thread pool saturation and CPU spikes leading to denial of service

How to detect it

Inspect application and access logs for requests carrying tracestate headers with unusually long whitespace sequences; correlate with thread dump or CPU profiling showing time spent in regex evaluation inside the propagator class.

What your security team should do

  • Prioritize upgrade to 1.67.0 across all Java services using OpenTelemetry within the next maintenance window
  • Add rate limiting or header size restrictions at ingress proxies as a temporary control
  • Monitor CPU and thread pool metrics for anomalous spikes correlated with trace ingestion
  • Review and update dependency manifests to prevent reintroduction of vulnerable versions

The record

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities