CVE-2026-114603 in Python
Summary
by MITRE • 10/22/2026
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified within OpenTelemetry Python versions prior to 1.45.1 represents a significant Availability risk stemming from inefficient regular expression handling during the parsing of W3C Trace Context headers. Specifically, the flaw resides in the TraceState.from_header function located within opentelemetry/trace/span.py, which is invoked via TraceContextTextMapPropagator.extract when processing incoming HTTP requests that carry trace context information. The core technical issue involves an unbounded optional-whitespace regular expression pattern used to parse these headers. When a malformed header contains a long sequence of spaces or tabs without the expected delimiter such as a comma, the regex engine engages in catastrophic backtracking. This behavior occurs because the parser attempts multiple combinations to satisfy the pattern before eventually failing and applying member-count limits, leading to exponential time complexity relative to the length of the whitespace sequence rather than linear processing.
From an operational perspective, this vulnerability allows for a remote denial-of-service attack against services that utilize the default W3C Trace Context propagator. An unauthenticated attacker can craft a specially crafted HTTP request with a header containing a sufficiently large run of spaces or tabs to trigger the quadratic backtracking behavior. Upon receiving such a request, the server's processing thread becomes occupied for an excessive amount of CPU time as it struggles to parse the malformed input. In synchronous worker environments, this effectively blocks that specific worker from handling other legitimate requests. Similarly, in asynchronous event loop architectures, the prolonged execution delays unrelated tasks running on the same loop, potentially causing widespread latency or unresponsiveness across the entire service rather than just isolating the impact to a single connection.
The security implications of this flaw are strictly limited to availability, as confirmed by the nature of the processing bottleneck. The vulnerability does not lead to data exfiltration, modification of telemetry data, or remote code execution. It serves purely as an resource exhaustion vector where computational resources are consumed disproportionately by a single malicious input. This aligns with CWE-400, which describes uncontrolled resource consumption, and specifically relates to inefficient regular expression complexity often categorized under CWE-1325 in the context of regex backtracking issues. Furthermore, this attack technique maps to MITRE ATT&CK tactic TA0004 Impact, particularly subtechniques related to service exhaustion or denial of service via application layer attacks such as HTTP Floods that exploit parsing inefficiencies.
Mitigation for this vulnerability requires upgrading OpenTelemetry Python to version 1.45.1 or later, where the regular expression logic has been corrected to prevent catastrophic backtracking on malformed whitespace sequences. For organizations unable to immediately patch their dependencies, defensive measures should include implementing strict input validation and size limits on HTTP headers at the reverse proxy, load balancer, or web server level before they reach the application layer. Additionally, configuring timeouts for request processing can help mitigate the impact by terminating long-running parsing operations that exceed expected duration thresholds, thereby preserving system stability even if a malicious payload is received.