Not an answer, but it would be very helpful if you could show us the ESAPI code and the immediate surrounding context that caused this or even better a short JUnit test to reproduce it.

From the looks of it, I'd say you are calling (possibly not directly) , you are calling this addHeader method and line 275 is throwing a ValidationException. However, the regex for the Validation.HTTPHeaderValue of

^[a-zA-Z0-9()-=*.?;,+/:&_ ]$

looks incorrect here as it would only allow a single character for a header value. Here's what it is supposed to be based on our default 2.5.2.0 ESAPI.properties file:

Validator.HTTPHeaderValue=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$

So I think what is triggering this is that the '*' missing before the ending '$' character on the regex.