CVE-2026-126360 OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api

The opentelemetry-api component in OpenTelemetry Python (prior to version 1.45.2 ) is vulnerable to a Denial of Service (DoS) via quadratic-time regular-expression backtracking. The issue occurs within TraceContextTextMapPropagator.extract() when processing a malformed traceparent value containin...

OPENSUSE-SU-2026:12408-1 python313-opentelemetry-api-1.45.1-1.1 on GA media

These are all security issues fixed in the python313-opentelemetry-api-1.45.1-1.1 package on the GA media of openSUSE Tumbleweed...

OpenTelemetry Python: Unbounded Tracestate Parsing In Opentelemetry-api

Summary "TraceState.fromheader" splits the inbound W3C "tracestate" header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request...

CVE-2026-114603

A flaw was found in opentelemetry-api. An unauthenticated remote attacker can cause a Denial of Service DoS by sending an HTTP request with a malformed tracing header containing an excessively long sequence of whitespace characters. Because the header parsing logic uses an inefficient regular...

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Summary TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request wit...

GHSA-XCQ7-P3PF-P88H OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Summary TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request wit...

a2a-acl (>=0.0.14, <=0.1.2), a2a-agentspeak (>=0.0.14, <=0.0.15) +1291 more potentially affected by CVE-2026-114603 via opentelemetry-api (>=0.1.0a0, <=1.45.0)

opentelemetry-api PYPI version =0.1.0a0, =0.0.14, =0.0.14, =1.1.3, =0.10.2.4rc3, =3.2.2, =0.1.0, =0.1.0rc1, =0.1.0, =0.5.2, =0.6.3 and more Source cves: CVE-2026-114603 Source advisory: MEND:CVE-2026-114603...

CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603

In OpenTelemetry Python versions prior to 1.45.1 , the opentelemetry-api component is vulnerable to a Regular Expression Denial of Service (ReDoS) . Specifically, the TraceState.from_header function in opentelemetry/trace/span.py (accessed via TraceContextTextMapPropagator.extract) uses an unboun...

CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

OpenTelemetry - CNCF OpenTelemetry Python resource management error vulnerability

OpenTelemetry: Versions prior to 1.45.1 of CNCF OpenTelemetry Python contain a resource management error vulnerability. This vulnerability stems from the TraceState.fromheader function in opentelemetry/trace/span.py within the opentelemetry-api. When parsing W3C trace state headers, it uses an...

PT-2026-121413

Name of the Vulnerable Software and Affected Versions opentelemetry-api versions 1.0.0 through 1.45.0 Description The TraceState.from header function in opentelemetry/trace/span.py, which is accessed via TraceContextTextMapPropagator.extract, uses a regular expression to parse inbound W3C...

RHLW-2026-B13520FAC3AB7893 Lightwell Security Advisory: opentelemetry-api 1.25.0.rhlw-00002

Red Hat Lightwell has released io.opentelemetry:opentelemetry-api 1.25.0.rhlw-00002 with a backported security fix. CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation This patched artifact is a drop-in replacement for io.opentelemetry:opentelemetry-api 1.25...

RHLW-2026-C5D9DDA1CBA52009 Lightwell Security Advisory: opentelemetry-api 1.28.0.rhlw-00002

Red Hat Lightwell has released io.opentelemetry:opentelemetry-api 1.28.0.rhlw-00002 with a backported security fix. CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation This patched artifact is a drop-in replacement for io.opentelemetry:opentelemetry-api 1.28...

ROOT-APP-MAVEN-CVE-2026-45292 CVE-2026-45292 in io.opentelemetry:opentelemetry-api - Patched by Root

Root has patched CVE-2026-45292 in the io.opentelemetry:opentelemetry-api package for Root:Maven. Multiple fixed versions available...

Malicious code in @epic-common/observability-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73d7457ccefffe2de1f0464f21ac2eadfb981be593d2b34ceb0d5cde1174da0b Package targets the private @epic-common scope Epic Games and is published to the public npm registry as a dependency-confusion vehicle. On import of...

CVE-2026-45292

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...

Memory Allocation with Excessive Size Value

Overview OpenTelemetry.Api is a package that application developers and library authors use to instrument their application/library. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processing of propagation headers such as baggage, B3, and...

CVE-2025-27513

OpenTelemetry.Api (OpenTelemetry .NET) version 1.10.0–1.11.1 is vulnerable to a DoS via tracestate/traceparent headers, causing high CPU and degraded performance. The issue is fixed in 1.11.2; upgrading is recommended. If not upgrading, exposed web/backend services processing such HTTP headers ma...