CVE-2026-126360
Received Received - Intake

ReDoS in OpenTelemetry Python API via Malformed Traceparent

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126360

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
open_telemetry opentelemetry-api 1.45.2
open_telemetry opentelemetry-python to 1.45.2 (exc)
opentelemetry opentelemetry_api 1.45.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a regular expression denial of service (ReDoS) in OpenTelemetry Python's TraceContextTextMapPropagator.extract() function. It occurs when processing malformed traceparent values containing a trace-context prefix, long whitespace sequences, and embedded newlines. The regex backtracking consumes excessive CPU, delaying unrelated requests on asynchronous servers.

Detection Guidance

Monitor for excessive CPU usage on systems running OpenTelemetry Python API versions 1.45.1 or earlier. Check logs for warnings about traceparent header parsing failures or oversized inputs. Use network monitoring tools to detect malformed traceparent headers with embedded newlines or long whitespace sequences.

Impact Analysis

An attacker could exploit this to cause high CPU usage and slow down or block unrelated requests on the same server. This leads to degraded performance or denial of service but does not allow data disclosure or code execution.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by consuming excessive CPU resources through regex backtracking, which may delay or block request processing. It does not directly lead to data disclosure or modification, but prolonged service disruption could impact availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.308(a)(7)). Compliance may be affected if systems fail to maintain timely access to personal data due to resource exhaustion.

Mitigation Strategies

Upgrade to opentelemetry-api version 1.45.2 or later. If immediate upgrade is not possible, validate and reject oversized or malformed traceparent values before processing. Implement input length limits (e.g., 512 characters) for traceparent headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126360. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...