GHSA-ccrj-gw8r-854m

Description

### Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma. ### Impact An unauthenticated attacker whose headers reach `W3CTraceContextPropagator.extract()` can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability. ### Patches Upgrade `io.opentelemetry:opentelemetry-api` to version **1.67.0** or later. [PR #8914](https://github.com/open-telemetry/opentelemetry-java/pull/8914) replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming. ### Workarounds If upgrading is not possible, reject or remove oversized `tracestate` headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.