GHSA-ccrj-gw8r-854m opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

• Maven io.opentelemetry:opentelemetry-api: < 1.67.0 → fixed in 1.67.0

Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma. Impact An unauthenticated attacker whose headers reach `W3CTraceContextPropagator.extract()` can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability. Patches Upgrade `io.opentelemetry:opentelemetry-api` to version 1.67.0 or later. PR #8914 replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming. Workarounds If upgrading is not possible, reject or remove oversized `tracestate` headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.