OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

影響: pip:opentelemetry-api <= 1.45.0 → 1.45.1

TraceState.from_header splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB tracestate keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time. Affected component / version - Package: opente…

GitHub Advisory Databaseで読む

2026/10/23 01:22、GitHub Advisory Databaseが「OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-114603。