CVE-2026-118259

Name of the Vulnerable Software and Affected Versions opentelemetry-java versions prior to 1.67.0

Description The W3CTraceContextPropagator.extract() function uses regex delimiter processing that can exhibit quadratic backtracking when parsing tracestate headers containing long sequences of spaces or tabs without a following comma. An unauthenticated attacker can send crafted headers to cause excessive CPU consumption and block request or event-loop threads, potentially leading to a denial of service. The actual impact is limited by proxy configuration, threading, and ingress header-size limits.

Recommendations Update to version 1.67.0. Reject or remove oversized tracestate headers before trace-context extraction.