CVE-2026-126360 · Package
NO FIX YET · SEE WHAT TO DO
The OpenTelemetry Python API's trace-context parser backtracks quadratically on a malformed traceparent value containing a long whitespace run and an embedded newline. An attacker can use this to consume CPU and delay unrelated requests on an asynchronous server's event loop, without disclosure or code execution.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Services that use the OpenTelemetry Python API to extract trace context from attacker-controlled input, especially asynchronous servers and JSON-based carriers such as MCP request metadata that can carry embedded newlines. Conforming HTTP header values cannot contain embedded newlines, so plain HTTP-header-only services are harder to reach. Services that do not extract incoming trace context can skip it.
Not affected if http-headers-only, no-incoming-trace-context
Who cares async-servers, mcp, opentelemetry, python
opentelemetry-api version with pip show opentelemetry-api and compare it to the fixed version.opentelemetry-api (Python): 1.45.2OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.