CVE-2026-114603

Name of the Vulnerable Software and Affected Versions opentelemetry-api versions 1.0.0 through 1.45.0

Description The TraceState.from header function in opentelemetry/trace/span.py, which is accessed via TraceContextTextMapPropagator.extract, uses a regular expression to parse inbound W3C tracestate headers. This regular expression contains an unbounded optional-whitespace run that can lead to quadratic backtracking when processing malformed headers containing long sequences of spaces or tabs without a following comma. This behavior results in excessive CPU consumption, which can occupy a synchronous worker or block the event loop in asynchronous servers, delaying unrelated requests and impacting service availability. The issue is triggered when the HTTP server or gateway accepts sufficiently large headers.

Recommendations Upgrade opentelemetry-api to version 1.45.1 or later. As a temporary workaround, ensure that HTTP header size limits are strictly configured at the server or gateway level to reject oversized headers.