UBUNTU-CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

Linux Distros Unpatched Vulnerability : CVE-2026-114603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in...

SUSE CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

OpenTelemetry Python: Unbounded Tracestate Parsing In Opentelemetry-api

Summary "TraceState.fromheader" splits the inbound W3C "tracestate" header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request...

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Summary TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request wit...

GHSA-XCQ7-P3PF-P88H OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Summary TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request wit...

CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

DEBIAN-CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603

In OpenTelemetry Python versions prior to 1.45.1 , the opentelemetry-api component is vulnerable to a Regular Expression Denial of Service (ReDoS) . Specifically, the TraceState.from_header function in opentelemetry/trace/span.py (accessed via TraceContextTextMapPropagator.extract) uses an unboun...

CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

EUVD-2026-108216

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

OpenTelemetry - CNCF OpenTelemetry Python resource management error vulnerability

OpenTelemetry: Versions prior to 1.45.1 of CNCF OpenTelemetry Python contain a resource management error vulnerability. This vulnerability stems from the TraceState.fromheader function in opentelemetry/trace/span.py within the opentelemetry-api. When parsing W3C trace state headers, it uses an...

PT-2026-121413

Name of the Vulnerable Software and Affected Versions opentelemetry-api versions 1.0.0 through 1.45.0 Description The TraceState.from header function in opentelemetry/trace/span.py, which is accessed via TraceContextTextMapPropagator.extract, uses a regular expression to parse inbound W3C...