{"id":"ghsa-ghsa-ccrj-gw8r-854m","seq":2056957,"kind":"advisory","title":"opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing","url":"https://github.com/advisories/GHSA-ccrj-gw8r-854m","permalink":"https://vulnpulse.app/items/ghsa-ghsa-ccrj-gw8r-854m","summary":"影響: maven:io.opentelemetry:opentelemetry-api <= 1.66.0 → 1.67.0\nOpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma. Impact An unauthenticated attacker whose headers reach W3CTraceContextPropagator.extract() can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affectin…","severity":"medium","techs":["java"],"cves":["CVE-2026-118259"],"tags":["GHSA-ccrj-gw8r-854m","io.opentelemetry:opentelemetry-api"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:07:40.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}