CLEANSTART-2026-AW13216 opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API

Security vulnerability affects the sonarqube package. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API...

CVE-2026-33701-Unsafe-Deserialization-in-OpenTelemetry-Java-Agent-RMI-Instrumentation

CVE-2026-33701 — Unsafe Deserialization in OpenTelemetry Java Agent RMI Instrumentation Severity: Critical CVSS v4.0: 9.3 Affected versions: opentelemetry-javaagent 2.26.1 Patched in: 2.26.1 released March 23, 2026 Overview OpenTelemetry is probably the most widely adopted observability framework...

Opentelemetry-java: Quadratic CPU Consumption In W3C Tracestate Parsing

Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted "tracestate" headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a followi...

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following...

GHSA-CCRJ-GW8R-854M opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following...

CVE-2026-118259

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate...

EUVD-2026-112368

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate...

CVE-2026-118259 opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate...

CVE-2026-118259 opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate...

CVE-2026-118259 opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate...

CVE-2026-118259

The opentelemetry-java library (versions prior to 1.67.0 ) is vulnerable to a ReDoS-style attack due to quadratic backtracking in the W3CTraceContextPropagator.extract() method. When parsing tracestate headers containing long sequences of spaces or tabs without a trailing comma, the regex delimit...

CVE-2026-118259

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate...

CVE-2026-118259: Inefficient Regular Expression Complexity

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate...

OpenTelemetry Java resource management error vulnerability

OpenTelemetry Java versions prior to 1.67.0 contain a resource management error vulnerability. This vulnerability arises because W3CTraceContextPropagator.extract uses regular expression delimiters when processing tracestate headers containing long strings of spaces or tabs without subsequent...

PT-2026-129126

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-56339 DESCRIPTION: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker...

CLEANSTART-2026-NF34256 opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API

Security vulnerability affects the elasticsearch package. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API...

PT-2026-132975

Security vulnerability affects the elasticsearch package. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API...

RHLW-2026-B13520FAC3AB7893 Lightwell Security Advisory: opentelemetry-api 1.25.0.rhlw-00002

Red Hat Lightwell has released io.opentelemetry:opentelemetry-api 1.25.0.rhlw-00002 with a backported security fix. CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation This patched artifact is a drop-in replacement for io.opentelemetry:opentelemetry-api 1.25...

RHLW-2026-C5D9DDA1CBA52009 Lightwell Security Advisory: opentelemetry-api 1.28.0.rhlw-00002

Red Hat Lightwell has released io.opentelemetry:opentelemetry-api 1.28.0.rhlw-00002 with a backported security fix. CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation This patched artifact is a drop-in replacement for io.opentelemetry:opentelemetry-api 1.28...