CVE-2026-114603

A flaw was found in opentelemetry-api. An unauthenticated remote attacker can cause a Denial of Service DoS by sending an HTTP request with a malformed tracing header containing an excessively long sequence of whitespace characters. Because the header parsing logic uses an inefficient regular...

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Summary TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request wit...

GHSA-XCQ7-P3PF-P88H OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Summary TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request wit...

CVE-2026-114603

In OpenTelemetry Python versions prior to 1.45.1 , the opentelemetry-api component is vulnerable to a Regular Expression Denial of Service (ReDoS) . Specifically, the TraceState.from_header function in opentelemetry/trace/span.py (accessed via TraceContextTextMapPropagator.extract) uses an unboun...

CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

ROOT-APP-MAVEN-CVE-2026-45292 CVE-2026-45292 in io.opentelemetry:opentelemetry-api - Patched by Root

Root has patched CVE-2026-45292 in the io.opentelemetry:opentelemetry-api package for Root:Maven. Multiple fixed versions available...

Malicious code in @epic-common/observability-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73d7457ccefffe2de1f0464f21ac2eadfb981be593d2b34ceb0d5cde1174da0b Package targets the private @epic-common scope Epic Games and is published to the public npm registry as a dependency-confusion vehicle. On import of...

CVE-2026-45292

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...

com.digitalpebble.stormcrawler:storm-crawler-aws (2.0), com.digitalpebble.stormcrawler:storm-crawler-core (2.0) +49 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-api (0.4.0)

io.opentelemetry:opentelemetry-api MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-api and may be impacted: - com.digitalpebble.stormcrawler:storm-crawler-aws 2.0 -...

com.couchbase.client:tracing-opentelemetry (0.2.8), com.lightstep.opentelemetry:opentelemetry-launcher (0.7.2) +30 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-api (0.7.1)

io.opentelemetry:opentelemetry-api MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-api and may be impacted: - com.couchbase.client:tracing-opentelemetry 0.2.8 -...

Memory Allocation with Excessive Size Value

Overview OpenTelemetry.Api is a package that application developers and library authors use to instrument their application/library. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processing of propagation headers such as baggage, B3, and...

CVE-2025-27513

OpenTelemetry.Api (OpenTelemetry .NET) version 1.10.0–1.11.1 is vulnerable to a DoS via tracestate/traceparent headers, causing high CPU and degraded performance. The issue is fixed in 1.11.2; upgrading is recommended. If not upgrading, exposed web/backend services processing such HTTP headers ma...

MAL-2024-11761 Malicious code in @opentelemetrya/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 77badbd499b685fa4658fe6151a9114e22077b0c7e1abb08079acc02c5b044ea The OpenSSF Package Analysis project identified '@opentelemetrya/api' @ 9.9.9 npm as malicious. It is considered malicious because: - The packag...

openSUSE Security Advisory (SUSE-SU-2024:1639-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:1639-1 Security update for python-arcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack, python-marshmallow, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-opentelemetry-sdk, python-opentelemetry-semantic-conventions, python-opentelemetry-test-utils, python-pycomposefile, python-pydash, python-redis, python-retrying, python-semver, python-sshtunnel, python-strictyaml, python-sure, python-vcrpy, python-xmltodict

This update for python-argcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack,...

SUSE SLES15: libprotobuf-lite20 / python2-cryptography / python2-psutil / etc (SUSE-SU-2023:2783-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2783-1 advisory. grpc: - Update in SLE-15 bsc1197726, bsc1144068 protobuf: - Fix a potential DoS issue in protobuf-cpp and protobuf-python, CVE-2022-1941,...