{"affected":[{"product":"opentelemetry-java","source":"CNA: GitHub_M","vendor":"open-telemetry","versions":[{"status":"affected","version":"< 1.67.0"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"io.opentelemetry:opentelemetry-api","product":"io.opentelemetry:opentelemetry-api","source":"OSV GHSA-ccrj-gw8r-854m","vendor":"","versions":[{"status":"affected","version":"0.10.0","versionType":"Maven"},{"status":"affected","version":"0.11.0","versionType":"Maven"},{"status":"affected","version":"0.12.0","versionType":"Maven"},{"status":"affected","version":"0.13.0","versionType":"Maven"},{"status":"affected","version":"0.13.1","versionType":"Maven"},{"status":"affected","version":"0.14.0","versionType":"Maven"},{"status":"affected","version":"0.14.1","versionType":"Maven"},{"status":"affected","version":"0.15.0","versionType":"Maven"},{"status":"affected","version":"0.16.0","versionType":"Maven"},{"status":"affected","version":"0.17.0","versionType":"Maven"},{"status":"affected","version":"0.17.1","versionType":"Maven"},{"status":"affected","version":"0.2.0","versionType":"Maven"},{"status":"affected","version":"0.2.1","versionType":"Maven"},{"status":"affected","version":"0.2.4","versionType":"Maven"},{"status":"affected","version":"0.3.0","versionType":"Maven"},{"status":"affected","version":"0.4.0","versionType":"Maven"},{"status":"affected","version":"0.4.1","versionType":"Maven"},{"status":"affected","version":"0.5.0","versionType":"Maven"},{"status":"affected","version":"0.6.0","versionType":"Maven"},{"status":"affected","version":"0.7.0","versionType":"Maven"},{"status":"affected","version":"0.7.1","versionType":"Maven"},{"status":"affected","version":"0.8.0","versionType":"Maven"},{"status":"affected","version":"0.9.0","versionType":"Maven"},{"status":"affected","version":"0.9.1","versionType":"Maven"},{"status":"affected","version":"1.0.0","versionType":"Maven"},{"status":"affected","version":"1.0.1","versionType":"Maven"},{"status":"affected","version":"1.1.0","versionType":"Maven"},{"status":"affected","version":"1.10.0","versionType":"Maven"},{"status":"affected","version":"1.10.0-rc.1","versionType":"Maven"},{"status":"affected","version":"1.10.0-rc.2","versionType":"Maven"},{"status":"affected","version":"1.10.1","versionType":"Maven"},{"status":"affected","version":"1.11.0","versionType":"Maven"},{"status":"affected","version":"1.12.0","versionType":"Maven"},{"status":"affected","version":"1.13.0","versionType":"Maven"},{"status":"affected","version":"1.14.0","versionType":"Maven"},{"status":"affected","version":"1.15.0","versionType":"Maven"},{"status":"affected","version":"1.16.0","versionType":"Maven"},{"status":"affected","version":"1.17.0","versionType":"Maven"},{"status":"affected","version":"1.18.0","versionType":"Maven"},{"status":"affected","version":"1.19.0","versionType":"Maven"},{"status":"affected","version":"1.2.0","versionType":"Maven"},{"status":"affected","version":"1.20.0","versionType":"Maven"},{"status":"affected","version":"1.20.1","versionType":"Maven"},{"status":"affected","version":"1.21.0","versionType":"Maven"},{"status":"affected","version":"1.22.0","versionType":"Maven"},{"status":"affected","version":"1.23.0","versionType":"Maven"},{"status":"affected","version":"1.23.1","versionType":"Maven"},{"status":"affected","version":"1.24.0","versionType":"Maven"},{"status":"affected","version":"1.25.0","versionType":"Maven"},{"status":"affected","version":"1.26.0","versionType":"Maven"},{"status":"affected","version":"1.27.0","versionType":"Maven"},{"status":"affected","version":"1.28.0","versionType":"Maven"},{"status":"affected","version":"1.29.0","versionType":"Maven"},{"status":"affected","version":"1.3.0","versionType":"Maven"},{"status":"affected","version":"1.30.0","versionType":"Maven"},{"status":"affected","version":"1.30.1","versionType":"Maven"},{"status":"affected","version":"1.31.0","versionType":"Maven"},{"status":"affected","version":"1.32.0","versionType":"Maven"},{"status":"affected","version":"1.33.0","versionType":"Maven"},{"status":"affected","version":"1.34.0","versionType":"Maven"},{"status":"affected","version":"1.34.1","versionType":"Maven"},{"status":"affected","version":"1.35.0","versionType":"Maven"},{"status":"affected","version":"1.36.0","versionType":"Maven"},{"status":"affected","version":"1.37.0","versionType":"Maven"},{"status":"affected","version":"1.38.0","versionType":"Maven"},{"status":"affected","version":"1.39.0","versionType":"Maven"},{"status":"affected","version":"1.4.0","versionType":"Maven"},{"status":"affected","version":"1.4.1","versionType":"Maven"},{"status":"affected","version":"1.40.0","versionType":"Maven"},{"status":"affected","version":"1.41.0","versionType":"Maven"},{"status":"affected","version":"1.42.0","versionType":"Maven"},{"status":"affected","version":"1.42.1","versionType":"Maven"},{"status":"affected","version":"1.43.0","versionType":"Maven"},{"status":"affected","version":"1.44.0","versionType":"Maven"},{"status":"affected","version":"1.44.1","versionType":"Maven"},{"status":"affected","version":"1.45.0","versionType":"Maven"},{"status":"affected","version":"1.46.0","versionType":"Maven"},{"status":"affected","version":"1.47.0","versionType":"Maven"},{"status":"affected","version":"1.48.0","versionType":"Maven"},{"status":"affected","version":"1.49.0","versionType":"Maven"},{"status":"affected","version":"1.5.0","versionType":"Maven"},{"status":"affected","version":"1.50.0","versionType":"Maven"},{"status":"affected","version":"1.51.0","versionType":"Maven"},{"status":"affected","version":"1.52.0","versionType":"Maven"},{"status":"affected","version":"1.53.0","versionType":"Maven"},{"status":"affected","version":"1.54.0","versionType":"Maven"},{"status":"affected","version":"1.54.1","versionType":"Maven"},{"status":"affected","version":"1.55.0","versionType":"Maven"},{"status":"affected","version":"1.56.0","versionType":"Maven"},{"status":"affected","version":"1.57.0","versionType":"Maven"},{"status":"affected","version":"1.58.0","versionType":"Maven"},{"status":"affected","version":"1.59.0","versionType":"Maven"},{"status":"affected","version":"1.6.0","versionType":"Maven"},{"status":"affected","version":"1.60.0","versionType":"Maven"},{"status":"affected","version":"1.60.1","versionType":"Maven"},{"status":"affected","version":"1.61.0","versionType":"Maven"},{"status":"affected","version":"1.62.0","versionType":"Maven"},{"status":"affected","version":"1.63.0","versionType":"Maven"},{"status":"affected","version":"1.64.0","versionType":"Maven"},{"status":"affected","version":"1.65.0","versionType":"Maven"},{"status":"affected","version":"1.66.0","versionType":"Maven"},{"status":"affected","version":"1.7.0","versionType":"Maven"},{"status":"affected","version":"1.7.1","versionType":"Maven"},{"status":"affected","version":"1.9.0","versionType":"Maven"},{"status":"affected","version":"1.9.1","versionType":"Maven"},{"events":[{"introduced":"0"},{"fixed":"1.67.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-118259","cwes":["CWE-1333"],"description":"opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.","epss":{"date":"2026-11-02","percentile":0.42154,"score":0.0049},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1793651439997,"publishedAt":1793213605875,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-java/pull/8914"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-ccrj-gw8r-854m"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-ccrj-gw8r-854m"}],"remediation":[{"kind":"fix","source":"OSV GHSA-ccrj-gw8r-854m","text":"io.opentelemetry:opentelemetry-api (Maven): OSV reports a fixed version 1.67.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-ccrj-gw8r-854m"}],"revision":"2a824acd3f14a5451ff68adecb222d2b0b6bc107051632de8f9fef6d4e81c025","sources":[{"modifiedAt":1793651439997,"name":"CNA: GitHub_M","retrievedAt":1793653754418,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118259"},{"modifiedAt":1793222104329,"name":"OSV / GitHub Security Advisories","retrievedAt":1793653757500,"url":"https://osv.dev/vulnerability/GHSA-ccrj-gw8r-854m"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793653780152,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118259"}],"ssvc":{"assessedAt":1793651426728,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing","updatedAt":1793653780152}