Product · open-telemetry

opentelemetry-java

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium 5.3

CVE-2026-118259

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic…

open-telemetry opentelemetry-java io.opentelemetry:opentelemetry-api Maven

Oct 28, 2026
Medium 5.3

CVE-2026-45292

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opente…

open-telemetry io.opentelemetry opentelemetry-java opentelemetry-extension-trace-propagators Maven

May 28, 2026