CVE-2026-126360: OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opentelemetry-apito a version that resolves this vulnerability.Fixed in 1.45.2
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this denial-of-service condition?
Deployments are exposed when they use opentelemetry-api before 1.45.2 and accept attacker-controlled propagation carriers that preserve embedded newlines and allow sufficiently large values. JSON-based carriers, including applicable MCP request metadata integrations, may meet these conditions depending on the SDK, instrumentation, and message-size limits.
Can a malicious standard HTTP traceparent header trigger the issue?
Conforming HTTP header values cannot contain embedded newlines, so a standard conforming HTTP header does not provide the required input. Exploitation depends on a carrier that retains an embedded newline.
What is the operational impact if exploitation succeeds?
A malformed traceparent can cause quadratic-time regular-expression backtracking during extraction, consuming excessive CPU. If parsing runs on an asynchronous server event-loop thread, unrelated requests can be delayed; the advisory does not establish data disclosure, modification, or code execution.
What remediation is identified?
Upgrade opentelemetry-api to version 1.45.2, which fixes the issue.