CVE-2026-118259

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing long runs of spaces or tabs without a following comma. An unauthenticated attacker whose headers reach extraction can repeatedly block request or event-loop threads and cause excessive CPU consumption, with practical impact bounded by ingress header-size limits, proxy configuration, and threading. This issue is fixed in version 1.67.0.

• CWE-1333

• https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5
• https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f
• https://github.com/open-telemetry/opentelemetry-java/pull/8914
• https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0
• https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118253Highcharts JS is a JavaScript charting library based on SVG.…8.4
• CVE-2026-118254Highcharts JS is a JavaScript charting library based on SVG.…8.6
• CVE-2026-118255Highcharts JS is a JavaScript charting library based on SVG.…8.4
• CVE-2026-118256Vue I18n is the internationalization plugin for Vue.js. From…2.1
• CVE-2026-118257Vue I18n is the internationalization plugin for Vue.js. From…7.2
• CVE-2026-118258i18next-http-backend is a backend layer for i18next that loa…3.7
• CVE-2026-11826OpenPLC_v3 contains a heap-based buffer overflow in the getD…8.8
• CVE-2026-118260Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118261Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118262Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4…8.2
• CVE-2026-118263Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5'…6.3
• CVE-2026-118264Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.…9.1