CVE-2026-118259: 
Java vulnerability analysis and mitigation

CVE-2026-118259 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Java implementation of OpenTelemetry (opentelemetry-java) affecting all versions prior to 1.67.0. The flaw resides in W3CTraceContextPropagator.extract(), which uses a regex-based delimiter pattern to parse W3C tracestate headers; crafted headers containing long runs of spaces or tabs without a following comma trigger quadratic backtracking, causing excessive CPU consumption. It was disclosed on October 28, 2026, with a patch released in version 1.67.0. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity). The vulnerable code in W3CTraceContextEncoding.java used a compiled Pattern ([ \t]*,[ \t]*) to split tracestate header entries; when a header contains a long sequence of spaces or tabs not followed by a comma, the regex engine exhibits quadratic backtracking behavior (CAPEC-492). An unauthenticated, network-accessible attacker only needs to send an HTTP request with a crafted tracestate header to any service that passes headers through W3CTraceContextPropagator.extract(). The fix in PR #8914 replaces the regex split with a literal lastIndexOf(',') scan and explicit character-by-character whitespace trimming, eliminating backtracking entirely (GitHub Advisory, Fix PR #8914, Fix Commit).

Successful exploitation causes the parsing thread to block for an extended period due to excessive CPU consumption, which can degrade or deny service availability — particularly severe when extraction runs on a shared event-loop thread, where a single malicious request can affect all concurrent connections. There is no confidentiality or integrity impact; the vulnerability is limited to availability (DoS). The practical severity is bounded by ingress header-size limits and proxy configuration, but repeated requests from an unauthenticated attacker can sustain the degradation (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. Exploitation requires no authentication, no privileges, and no user interaction — only the ability to send HTTP headers to a service using the affected library (GitHub Advisory, Feedly).

1. Identify target: Locate a service instrumented with opentelemetry-java versions ≤ 1.66.0 that accepts inbound HTTP requests and passes headers to W3CTraceContextPropagator.extract() (e.g., a microservice using the OpenTelemetry Java agent or SDK with W3C trace context propagation enabled).
2. Craft malicious header: Construct an HTTP request with a tracestate header containing a valid key-value pair followed by a very long run of spaces or tabs without a comma — for example: tracestate: foo=bar followed by 100,000 space characters and then a non-comma character (e.g., x).
3. Send the request: Transmit the crafted HTTP request to any endpoint of the target service. No authentication is required.
4. Trigger ReDoS: The TRACESTATE_ENTRY_DELIMITER_SPLIT_PATTERN regex ([ \t]*,[ \t]*) applied to the malformed header causes quadratic backtracking in the Java regex engine, blocking the calling thread for a disproportionately long time.
5. Repeat for sustained DoS: Send the request repeatedly to keep threads occupied, degrading or denying service to legitimate users — especially effective against event-loop-based frameworks where thread blocking affects all concurrent connections (GitHub Advisory, Fix Commit).

• Network: Repeated HTTP requests containing abnormally large tracestate headers (hundreds of kilobytes of whitespace characters) from the same or rotating source IPs.
• Process/CPU: Sustained high CPU utilization on the Java process handling incoming requests, particularly in threads executing W3CTraceContextEncoding.decodeTraceState() or W3CTraceContextPropagator.extract().
• Logs: Application logs or APM traces showing unusually long request processing times or thread stalls correlated with requests containing large tracestate headers; thread dump output showing threads blocked in java.util.regex classes (e.g., Pattern, Matcher) during tracestate parsing.
• Infrastructure: Increased request latency or timeout errors reported by downstream services or load balancers coinciding with the arrival of oversized tracestate headers.

Upgrade io.opentelemetry:opentelemetry-api (and related opentelemetry-java artifacts) to version 1.67.0 or later, which replaces the vulnerable regex-based parsing with a backtracking-free literal comma scan (GitHub Release v1.67.0). As a temporary workaround if upgrading is not immediately possible, configure ingress proxies or API gateways to reject or truncate oversized tracestate headers before they reach the application; this reduces per-request parsing cost but does not fully eliminate the risk from repeated requests (GitHub Advisory).