OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

影響: pip:opentelemetry-api <= 1.45.0 → 1.45.1

TraceState.from_header splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB tracestate keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time. Affected component / version - Package: opente…

Read on GitHub Advisory Database

On 10/23/2026, 01:22 AM, GitHub Advisory Database published "OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api" (type: Advisory). Severity is "Medium" (medium). Related technologies: Python. CVE: CVE-2026-114603.