OpenTelemetry Python: Unbounded Tracestate Parsing In Opentelemetry-api

Summary "TraceState.fromheader" splits the inbound W3C "tracestate" header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request...