Performance Issue in OpenTelemetry Python SDK
CVE-2026-114603

5.3MEDIUM

Key Information:

Vendor

Open-telemetry

Status
Opentelemetry-python
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114603?

The OpenTelemetry Python SDK contains a performance issue in the TraceState.from_header function. Prior to version 1.45.1, this function utilized an unbounded optional-whitespace regular expression for parsing W3C tracestate headers. As a result, a malformed header comprised of excessive spaces or tabs could trigger quadratic backtracking, leading to significant CPU utilization during processing of unauthenticated requests. This performance degradation can occupy synchronous workers or delay other requests in an asynchronous event loop, ultimately affecting the availability of services. However, this issue does not compromise telemetry data integrity or enable unauthorized code execution. The vulnerability has been resolved in version 1.45.1.

Affected Version(s)

opentelemetry-python < 1.45.1

References

https://github.com/open-telemetry/opentelemetry-python/se...
x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-python/pu...
x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-python/co...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.