UBUNTU-CVE-2026-126360

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-126360

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-126360.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-126360

Upstream

CVE-2026-126360

Published

2026-11-13T00:00:00Z

Modified

2026-11-13T21:05:25Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.

References

Affected packages

Ubuntu:26.10 / python-opentelemetry

Package

Name: python-opentelemetry
Purl: pkg:deb/ubuntu/python-opentelemetry?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.39.1-2

1.42.1-1

1.43.0-1

1.44.0-1

1.44.0-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-opentelemetry-api",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-configuration",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-exporter-otlp",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-exporter-otlp-proto-common",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-exporter-otlp-proto-grpc",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-exporter-otlp-proto-http",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-exporter-prometheus",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-exporter-zipkin-json",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-exporter-zipkin-proto-http",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-opentracing-shim",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-propagator-b3",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-propagator-jaeger",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-proto",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-proto-json",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-sdk",
            "binary_version": "1.44.0-2"
        },
        {
            "binary_name": "python3-opentelemetry-semantic-conventions",
            "binary_version": "1.44.0-2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-126360.json"

Ubuntu:26.04:LTS / python-opentelemetry