CVE-2026-114603

What it actually does

Unbounded optional-whitespace regex in TraceState.from_header (opentelemetry/trace/span.py) reached via TraceContextTextMapPropagator.extract performs catastrophic backtracking on malformed W3C tracestate headers containing long runs of spaces or tabs without a comma, consuming excessive CPU before the member-count limit applies.

Why it matters to the business

A single unauthenticated request can occupy a synchronous worker thread or delay unrelated work on an asynchronous event loop, degrading service availability and responsiveness until the request completes or is terminated.

How an attack unfolds

An attacker crafts an HTTP request containing a W3C tracestate header with a long sequence of whitespace characters and no terminating comma, sends it to any endpoint instrumented with the default OpenTelemetry propagator, and triggers quadratic CPU consumption during header parsing.

How to fix it

Upgrade opentelemetry-api to version 1.45.1 or later. If immediate upgrade is not possible, implement request-size or header-size limits at the web server, reverse proxy, or gateway layer before the Python application processes the request.

How to confirm the fix worked

Confirm opentelemetry-api package version is 1.45.1 or newer; replay a test request containing a 100k+ character whitespace-only tracestate header and verify CPU usage remains bounded and request completes promptly.

Typical attack path

1. Craft HTTP request with oversized tracestate header consisting of repeated spaces or tabs without commas
2. Transmit request to any service endpoint that extracts W3C Trace Context headers
3. Server invokes TraceContextTextMapPropagator.extract which calls TraceState.from_header
4. Regex engine performs quadratic backtracking consuming CPU until member limit check or timeout

How to detect it

Inspect HTTP access logs and application request logs for unusually large tracestate header values; correlate with process CPU spikes or long-running request traces in observability data; search for repeated requests containing long runs of whitespace in the tracestate header.

• tracestate header containing 10000+ consecutive space or tab characters
• TraceState.from_header
• opentelemetry/trace/span.py

What your security team should do

• Upgrade all OpenTelemetry Python deployments to opentelemetry-api >= 1.45.1 within the next maintenance window
• Add HTTP header size limits or request timeouts at the load balancer or WSGI server level as a compensating control
• Monitor application CPU and request latency for sudden spikes correlated with inbound traceparent/tracestate headers