Vulnerability · Published Oct 22, 2026 · Assigned by GitHub_M

CVE-2026-114603OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in opentelemetry-python from open-telemetry. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 57.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	python-opentelemetry	1.45.1-1	DEBIAN-CVE-2026-114603
PyPI	opentelemetry-api	1.45.1	GHSA-xcq7-p3pf-p88h
Ubuntu:26.04:LTS	python-opentelemetry	no fix listed	UBUNTU-CVE-2026-114603
Ubuntu:26.10	python-opentelemetry	no fix listed	UBUNTU-CVE-2026-114603

Affected products (as reported)

Vendor	Product	Versions
open-telemetry	opentelemetry-python	< 1.45.1

Weakness: CWE-400, CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-python/pull/5749 x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06 x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1 x_refsource_MISC