OpenTelemetry Java CVE-2026-118259

Exploitation requires that attacker-controlled 'tracestate' request headers actually reach W3CTraceContextPropagator.extract() in an application running opentelemetry-api <=1.66.0 with W3C trace-context extraction of incoming requests enabled (the common OpenTelemetry propagation default). No authentication or user interaction is needed (PR:N/UI:N). The crafted header must contain a long run of spaces or tabs without a following comma to trigger quadratic regex backtracking. Limiting factors that reduce realistic impact: ingress/proxy header-size limits cap the per-request parsing cost (so attackers rely on repeated requests), and severity is amplified only when extraction runs on a shared request or event-loop thread that can starve other connections; deployments that strip or bound tracestate headers upstream, or that never extract remote trace context, are not exposed.

This is a medium-severity denial-of-service (CWE-1333, ReDoS) in OpenTelemetry Java's W3C trace-context propagator, and the signals are internally consistent rather than conflicting. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) correctly reflects a network-reachable, unauthenticated, low-complexity issue whose only impact is limited availability loss (C:N/I:N/A:L) - there is no confidentiality or integrity exposure and no scope change. The GHSA advisory and the fix commit confirm the mechanism: regex delimiter splitting (Pattern '[ \t]*,[ \t]*') backtracks quadratically on tracestate headers with long runs of spaces/tabs lacking a following comma. No EPSS score is present in the input and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation - treat this as no public exploit identified at time of analysis, though the fix commit itself ships a reproducing @Timeout test that fills 100,000 whitespace characters and demonstrates the quadratic parsing cost, so the trigger condition is publicly documented. The vuln.today decision label is 'this_month', i.e. a genuine but non-emergency priority. Crucially, both the description and GHSA state real-world impact is bounded by ingress header-size limits, proxy configuration, and threading - header-size caps reduce but do not eliminate the per-request cost - so for most deployments this is a patch-this-cycle hardening item rather than a drop-everything emergency, with elevated concern only where tracestate extraction runs on a shared event-loop thread.

An unauthenticated attacker sends HTTP requests to an instrumented service with a crafted tracestate header such as 'foo=bar' followed by a long run of spaces or tabs with no trailing comma. When W3CTraceContextPropagator.extract() parses the header, the delimiter regex backtracks quadratically and pins the parsing thread's CPU; repeating this across many requests - especially where extraction runs on a shared event-loop thread - degrades or denies service to other connections. No weaponized public exploit is identified, but the fix commit includes a timing test that demonstrates the quadratic behavior with 100,000 whitespace characters.