CVE-2026-126360 OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api

The opentelemetry-api component in OpenTelemetry Python (prior to version 1.45.2 ) is vulnerable to a Denial of Service (DoS) via quadratic-time regular-expression backtracking. The issue occurs within TraceContextTextMapPropagator.extract() when processing a malformed traceparent value containin...

Allocation of Resources Without Limits or Throttling

Overview OpenTelemetry.Api is a package that application developers and library authors use to instrument their application/library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper handling of tracestate and traceparent...

CVE-2025-27513

OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service DoS when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these...

PT-2025-9847

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Api versions 1.10.0 through 1.11.1 Description A vulnerability in OpenTelemetry.Api could cause a Denial of Service DoS when a tracestate and traceparent header is received. This issue impacts any application accessible over the...

CVE-2025-27513: Allocation of Resources Without Limits or Throttling

OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service DoS when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these...