Zero Radar
← feed
MediumVulnerabilityCVE-2026-118259updated 29 Oct 2026, 16:24 UTC

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Fix availableOfficial, 2 sources
SeverityMediumCVSS 5.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesio.opentelemetry:opentelemetry-api 1.67.0 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

Are you affected?

Package / productAffected versionsFixed in
io.opentelemetry:opentelemetry-api · maven<= 1.66.01.67.0

Timeline

  1. 28 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 21:07 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 28 Oct 2026, 21:08 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 16:24 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118259 · GHSA-ccrj-gw8r-854m
CVSS
5.3 / 10
Disclosed
28 Oct 2026, 19:17 UTC
On Zero Radar
28 Oct 2026, 21:08 UTC (2 h after disclosure)
Last change
29 Oct 2026, 16:24 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing · Zero Radar