{"id":"CVE-2026-126360","summary":"OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api","details":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.","aliases":["GHSA-mf5v-w3w3-f6cg"],"modified":"2026-11-14T02:47:28.979052310Z","published":"2026-11-12T22:24:22.023Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126360.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1333"]},"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126360.json"},{"type":"ADVISORY","url":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126360"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-python/pull/5818"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-python/pull/5856"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-telemetry/opentelemetry-python","events":[{"introduced":"0"},{"fixed":"ad755945ad69008219e661c33ff1d72ff1bbcb51"},{"fixed":"78123a2755c907c602e02352aebed4be86aa5350"},{"fixed":"faa72dae511ae64a7bf8ca63eff9ad4387d0b939"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"1.45.2"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"78123a2755c907c602e02352aebed4be86aa5350"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"faa72dae511ae64a7bf8ca63eff9ad4387d0b939"}]},{"range":[{"fixed":"ad755945ad69008219e661c33ff1d72ff1bbcb51"}],"source":"REFERENCES_TAG","original_tag":"v1.45.2"}]}}],"versions":["v1.45.1","v1.45.0","stable","v1.13.0","v1.12.0","v1.12.0rc2","v1.12.0rc1","v1.11.1","v1.11.0","v1.10.0","v1.9.1","v1.9.0","v1.8.0","v1.7.1","v1.7.0","v1.6.2","v1.6.1","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.0.0","v0.19b0","v0.17b0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126360.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}