W3CTraceContextPropagator.extract() in opentelemetry-java performed regex parsing of the tracestate header that can exhibit quadratic backtracking when the header contains long sequences of spaces or tabs without a following comma. An unauthenticated attacker can supply such a header and repeatedly block request or event‑loop threads, leading to high CPU usage. The primary impact is a denial‑of‑service condition and possible exhaustion of processing resources for a target application.

The vulnerability affects the open-telemetry:opentelemetry-java implementation of the OpenTelemetry API and SDK. All releases earlier than 1.67.0 contain the issue. Updating to version 1.67.0 or later removes the affected code path.

The CVSS score of 5.3 indicates a moderate severity. Exploitation requires the ability to supply custom tracestate headers in incoming requests; authentication is not required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an external attacker sending malicious HTTP headers, which can be abused if no header size restrictions or input validation are in place.