CVE-2026-118259 | opentelemetry-java up to 1.66.x Trace Context Propagator W3CTraceContextPropagator.extract incorrect regex

October 28, 2026 Yanac

A vulnerability described as problematic has been identified in opentelemetry-java up to 1.66.x. Affected is the function W3CTraceContextPropagator.extract of the component Trace Context Propagator. Such manipulation leads to incorrect regular expression.

This vulnerability is traded as CVE-2026-118259. The attack may be launched remotely. There is no exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More