## OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-114603
- 公開日時: 2026-10-22T16:22:07.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-xcq7-p3pf-p88h)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-xcq7-p3pf-p88h

影響: pip:opentelemetry-api <= 1.45.0 → 1.45.1
TraceState.from_header splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB tracestate keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time. Affected component / version - Package: opente…