CVE-2026-114603: OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
TraceState.from_header splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB tracestate keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time.
TraceState.from_header() in opentelemetry-api used a regular-expression-based operation whose processing time could grow disproportionately when parsing specially crafted inbound tracestate headers.
Because W3C Trace Context is enabled by default in OpenTelemetry Python, services accepting untrusted propagation headers could spend excessive CPU time processing a single request.
References
- github.com/advisories/GHSA-xcq7-p3pf-p88h
- github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md
- github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b
- github.com/open-telemetry/opentelemetry-python/pull/5749
- github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1
- github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h
- nvd.nist.gov/vuln/detail/CVE-2026-114603
Code Behaviors & Features
Detect and mitigate CVE-2026-114603 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →