CVE-2026-114603

MediumCVSS 5.3

Published: 22/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

42th percentile - higher than 42% of all known CVEs

Summary

OpenTelemetry Python prior to 1.45.1 contains the TraceState.from_header function, which parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking, leading to excessive CPU consumption on a single unauthenticated request.

Risk Assessment

An attacker could cause CPU exhaustion and delays in handling other requests, leading to partial denial of service. The impact is limited to availability and does not allow modification of telemetry data or code execution.

Recommendation

Update OpenTelemetry Python to version 1.45.1 or later. Consider limiting HTTP header sizes at the server or gateway level.

Other vulnerabilities in OpenTelemetry Python

CVE-2026-116694Medium
In OpenTelemetry Python prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. When an untrusted carrier supplies numerous or oversized values, the service performs unnecessary CPU work and short-lived heap allocations, contributing to denial of service.

Original NVD description (English source)

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS