OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

影響: pip:opentelemetry-api <= 1.45.0 → 1.45.1

TraceState.from_header splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB tracestate keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time. Affected component / version - Package: opente…

在 GitHub Advisory Database 阅读

2026/10/23 01:22，GitHub Advisory Database 发布了“OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-114603。