CVE-2026-126360
- Source
- https://cve.org/CVERecord?id=CVE-2026-126360
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126360.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-126360
- Aliases
- Downstream
CGA (34)
- CGA-32j7-f5h5-j958
- CGA-3826-vpph-r5v6
- CGA-3jj6-rm5w-7qpv
- CGA-3mmh-827j-35gp
- CGA-4xfq-mv7r-92gp
- CGA-59hc-gqcq-gfq4
- CGA-5pw4-6jg8-h59h
- CGA-62w2-c6hh-vxrh
- CGA-6q8v-qvgp-68cr
- CGA-78h3-jmwg-j8mr
- CGA-7p4h-vpj9-2ccp
- CGA-8hfj-cvhj-45p5
- CGA-8rv8-rxxm-vxgv
- CGA-f6xf-hfh6-9942
- CGA-fg9p-4h72-7wm3
- CGA-g5rv-j7hq-637w
- CGA-g6jr-86cm-2hwg
- CGA-gc4x-8pq5-mwmg
- CGA-hrh3-68pr-956g
- CGA-j6vg-cxrp-jq98
- CGA-jpj5-8vg5-6xcw
- CGA-m5pm-3h6q-2qj7
- CGA-m5wv-9m9j-6vjr
- CGA-mc98-vgxc-g4mm
- CGA-mgmv-w2xw-qc4w
- CGA-mhx6-gxjq-f6q9
- CGA-p3cv-3m7v-998r
- CGA-p7fh-5vjv-hwxh
- CGA-r948-j77h-q79p
- CGA-rffh-q49f-6x6w
- CGA-rh33-m2jj-r7q8
- CGA-rpc2-mf7g-ww3p
- CGA-v2rw-xr6q-qj4r
- CGA-x9v5-vf4v-3cwr
MINI (1)
UBUNTU (1)
- Published
- 2026-11-12T22:24:22Z
- Modified
- 2026-11-14T02:47:28Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api
- Details
-
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1333" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126360.json" }- References
-
- https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126360.json
- https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg
- https://nvd.nist.gov/vuln/detail/CVE-2026-126360
- https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350
- https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939
- https://github.com/open-telemetry/opentelemetry-python/pull/5818
- https://github.com/open-telemetry/opentelemetry-python/pull/5856
Affected packages
Git / github.com/open-telemetry/opentelemetry-python
Affected ranges
- Type
- GIT
- Repo
- https://github.com/open-telemetry/opentelemetry-python
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "1.45.2" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "78123a2755c907c602e02352aebed4be86aa5350" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "faa72dae511ae64a7bf8ca63eff9ad4387d0b939" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.45.2", "range": [ { "fixed": "ad755945ad69008219e661c33ff1d72ff1bbcb51" } ], "source": "REFERENCES_TAG" } ] }