CVE-2026-118259

The opentelemetry-java library (versions prior to 1.67.0 ) is vulnerable to a ReDoS-style attack due to quadratic backtracking in the W3CTraceContextPropagator.extract() method. When parsing tracestate headers containing long sequences of spaces or tabs without a trailing comma, the regex delimit...