Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

opentelemetry-api

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3PyPIAmendedPublished

    OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

    CVE-2026-114603 · GHSA-xcq7-p3pf-p88h

    Affected
    • PyPI opentelemetry-api <= 1.45.0
    Fixed in
    1.45.1· Vendor fix available
    Issue
    TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB tracestate keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time. Affected component / version - Package: opentelemetry-api (pip) — opentelemetry/trace/span.py (TraceState.fromheader), reached from opentelemetry/trace/propagation/tracecontext.py (TraceContextTextMapPropagator.extract). - Confirmed in main (5e8083e8) and in the v1.44.0 and v1.45.0 tags; the same pattern is present back to v1.0.0 (introduced by #1599, March 2021). Not exhaustively verified against every release in between. - Reachable with the default propagators (OTELPROPAGATORS defaults to tracecontext,baggage) from any server…

    Recommended action: Upgrade to 1.45.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →