Vulnerability in OpenTelemetry Java Implementation Affects Telemetry Management

CVE-2026-118259

What is CVE-2026-118259?

The Java implementation of OpenTelemetry exhibits a vulnerability in the W3CTraceContextPropagator.extract() method prior to version 1.67.0. This issue arises from regex delimiter processing, which may lead to quadratic backtracking when parsing tracestate headers filled with extensive spaces or tabs without a following comma. An unauthenticated attacker can exploit this flaw by sending crafted headers to the application, potentially blocking request or event-loop threads and resulting in excessive CPU consumption. This situation is particularly affected by ingress header-size limits and proxy configuration. This vulnerability has been addressed in version 1.67.0.

References