OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

影響: pip:opentelemetry-api <= 1.45.0 → 1.45.1

TraceState.from_header splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB tracestate keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time. Affected component / version - Package: opente…

GitHub Advisory Database에서 읽기

2026. 10. 23. 오전 01:22, GitHub Advisory Database에서 "OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-114603.