CVE-2026-114603

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114603
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114603.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114603
Aliases
Downstream
CGA (60)
ECHO (1)
Published
2026-10-22T15:29:25Z
Modified
2026-10-23T02:45:44Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
Details

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1333",
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114603.json"
}
References

Affected packages

Git / github.com/open-telemetry/opentelemetry-python

Affected ranges

Type
GIT
Repo
https://github.com/open-telemetry/opentelemetry-python
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
14971cef9c84c2354cbaf6871090896fad0f9a1a
Fixed
d5224bf4ffdf2aee1b592ad238dcc32ca957f26b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.45.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "d5224bf4ffdf2aee1b592ad238dcc32ca957f26b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.45.1",
            "range":  [
                {
                    "fixed":  "14971cef9c84c2354cbaf6871090896fad0f9a1a"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.17b0
v0.19b0
v1.*
v1.0.0
v1.10.0
v1.11.0
v1.11.1
v1.12.0
v1.12.0rc1
v1.12.0rc2
v1.13.0
v1.2.0
v1.3.0
v1.4.0
v1.45.0
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114603.json"