opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…y-java/security/advisories/GHSA-ccrj-gw8r-854m Diğer
• github.com/open-telemetry/opentelemetry-java/pull/8914 Diğer
• github.com/…ommit/ba4dfea91647d1ef596975db5d7197681df3c0f5 Diğer
• github.com/…ommit/cc4f5f22aed0d69369941cde8029e73507cf438f Diğer
• github.com/…emetry/opentelemetry-java/releases/tag/v1.67.0 Diğer

Kayıt geçmişi

1. 28 Eki 2026 21:53Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-118686EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex
• 6,5 CVE-2026-118646n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
• 7,5 CVE-2026-116795RE2JS: Quadratic-time denial of service in re2js lookbehind matching
• 7,5 CVE-2026-118037Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing
• 8,7 CVE-2026-116693dd-trace-js: URL sorgu dizesi gizleme ifadesinde ReDoS zafiyeti
• 8,7 CVE-2026-116588dd-trace-py URL sorgu dizesi gizleme işleminde ReDoS zafiyeti