{"id":"CVE-2026-126360","kind":"vulnerability","aliases":["CVE-2026-126360"],"related":[],"title":"OpenTelemetry Python API: crafted traceparent header stalls request handling","description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.","summary":"The OpenTelemetry Python API's trace-context parser backtracks quadratically on a malformed traceparent value containing a long whitespace run and an embedded newline. An attacker can use this to consume CPU and delay unrelated requests on an asynchronous server's event loop, without disclosure or code execution.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["async-servers","mcp","opentelemetry","package","python"],"not_affected_if":["http-headers-only","no-incoming-trace-context"],"how_to_check":"- Check the installed `opentelemetry-api` version with `pip show opentelemetry-api` and compare it to the fixed version.\n- Look for services that parse traceparent from JSON-based carriers or MCP request metadata with newlines preserved.","fix":"- `opentelemetry-api` (Python): `1.45.2`","status":"open","published_at":"2026-11-13T00:20:11+00:00","first_seen_at":"2026-11-13T00:41:06+00:00","triaged_at":"2026-11-13T00:41:24+00:00","updated_at":"2026-11-13T00:41:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T00:41:24Z","model":"claude-haiku-5-5","output":{"fix":"- `opentelemetry-api` (Python): `1.45.2`","reach":"network","title":"OpenTelemetry Python API: crafted traceparent header stalls request handling","impact":"low","summary":"The OpenTelemetry Python API's trace-context parser backtracks quadratically on a malformed traceparent value containing a long whitespace run and an embedded newline. An attacker can use this to consume CPU and delay unrelated requests on an asynchronous server's event loop, without disclosure or code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","opentelemetry","mcp","async-servers"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Event loop stalls from CPU exhaustion, delaying unrelated requests","analyst_note":"","how_to_check":"- Check the installed `opentelemetry-api` version with `pip show opentelemetry-api` and compare it to the fixed version.\n- Look for services that parse traceparent from JSON-based carriers or MCP request metadata with newlines preserved.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["http-headers-only","no-incoming-trace-context"],"who_is_affected":"Services that use the OpenTelemetry Python API to extract trace context from attacker-controlled input, especially asynchronous servers and JSON-based carriers such as MCP request metadata that can carry embedded newlines. Conforming HTTP header values cannot contain embedded newlines, so plain HTTP-header-only services are harder to reach. Services that do not extract incoming trace context can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000781,"input_tokens":4815,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126360':12A,15A '-2026':11A,14A '1.45.2':84C,204C 'advisori':189C 'api':3A,26B,77C,89C 'applic':149C 'async':17B 'async-serv':16B 'asynchron':62B,172C 'attack':49B,122C 'attacker-control':121C 'backtrack':32B,98C 'base':146C 'cannot':140C 'carrier':124C,147C 'code':70B,196C 'conform':136C 'consum':54B,180C 'contain':39B,104C,141C 'context':30B,108C 'control':123C 'cpu':55B,182C 'craft':4A 'cve':10A,13A 'delay':57B,184C 'depend':159C 'disclosur':68B,193C 'embed':46B,116C,127C,142C 'establish':192C 'event':65B,176C 'event-loop':175C 'excess':181C 'execut':71B,197C 'exploit':118C 'express':97C 'fix':201C 'handl':9A 'header':6A,138C 'http':137C 'includ':148C 'instrument':163C 'integr':153C 'issu':199C 'json':145C 'json-bas':144C 'larg':133C 'limit':168C 'long':41B,111C 'loop':66B,177C 'malform':36B,101C 'mcp':19B,150C 'messag':166C 'message-s':165C 'metadata':152C 'modif':194C 'newlin':47B,117C,128C,143C,158C 'opentelemetri':1A,20B,24B,72C,81C,88C 'opentelemetry-api':87C 'packag':21B 'pars':169C 'parser':31B 'perform':91C 'permit':130C 'prefix':109C 'preserv':126C,155C 'prior':82C 'provid':74C 'python':2A,22B,25B,73C,76C 'quadrat':33B,93C 'quadratic-tim':92C 'regular':96C 'regular-express':95C 'request':8A,59B,151C,186C 'requir':119C,157C 'run':43B 'sdk':79C,162C 'sequenc':113C 'server':18B,63B,173C 'size':167C 'stall':7A 'suffici':132C 'thread':178C 'time':94C 'trace':29B,107C 'trace-context':28B,106C 'tracecontexttextmappropagator.extract':85C 'tracepar':5A,37B,102C 'unrel':58B,185C 'use':51B 'valu':38B,103C,134C,139C 'version':203C 'whitespac':42B,112C 'without':67B","nicknames":[],"mitigations":[],"who_affected":"Services that use the OpenTelemetry Python API to extract trace context from attacker-controlled input, especially asynchronous servers and JSON-based carriers such as MCP request metadata that can carry embedded newlines. Conforming HTTP header values cannot contain embedded newlines, so plain HTTP-header-only services are harder to reach. Services that do not extract incoming trace context can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["asyncservers","mcp","medium","opentelemetry","package","python"],"campaign_type":null,"search_a":"'-126360':12A,15A '-2026':11A,14A 'api':3A 'craft':4A 'cve':10A,13A 'handl':9A 'header':6A 'opentelemetri':1A 'python':2A 'request':8A 'stall':7A 'tracepar':5A","search_b":"'api':26B 'async':17B 'async-serv':16B 'asynchron':62B 'attack':49B 'backtrack':32B 'code':70B 'consum':54B 'contain':39B 'context':30B 'cpu':55B 'delay':57B 'disclosur':68B 'embed':46B 'event':65B 'execut':71B 'long':41B 'loop':66B 'malform':36B 'mcp':19B 'newlin':47B 'opentelemetri':20B,24B 'packag':21B 'parser':31B 'python':22B,25B 'quadrat':33B 'request':59B 'run':43B 'server':18B,63B 'trace':29B 'trace-context':28B 'tracepar':37B 'unrel':58B 'use':51B 'valu':38B 'whitespac':42B 'without':67B","search_c":"'1.45.2':84C,204C 'advisori':189C 'api':77C,89C 'applic':149C 'asynchron':172C 'attack':122C 'attacker-control':121C 'backtrack':98C 'base':146C 'cannot':140C 'carrier':124C,147C 'code':196C 'conform':136C 'consum':180C 'contain':104C,141C 'context':108C 'control':123C 'cpu':182C 'delay':184C 'depend':159C 'disclosur':193C 'embed':116C,127C,142C 'establish':192C 'event':176C 'event-loop':175C 'excess':181C 'execut':197C 'exploit':118C 'express':97C 'fix':201C 'header':138C 'http':137C 'includ':148C 'instrument':163C 'integr':153C 'issu':199C 'json':145C 'json-bas':144C 'larg':133C 'limit':168C 'long':111C 'loop':177C 'malform':101C 'mcp':150C 'messag':166C 'message-s':165C 'metadata':152C 'modif':194C 'newlin':117C,128C,143C,158C 'opentelemetri':72C,81C,88C 'opentelemetry-api':87C 'pars':169C 'perform':91C 'permit':130C 'prefix':109C 'preserv':126C,155C 'prior':82C 'provid':74C 'python':73C,76C 'quadrat':93C 'quadratic-tim':92C 'regular':96C 'regular-express':95C 'request':151C,186C 'requir':119C,157C 'sdk':79C,162C 'sequenc':113C 'server':173C 'size':167C 'suffici':132C 'thread':178C 'time':94C 'trace':107C 'trace-context':106C 'tracecontexttextmappropagator.extract':85C 'tracepar':102C 'unrel':185C 'valu':103C,134C,139C 'version':203C 'whitespac':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-05T17:03:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126360","severity":null,"published_at":"2026-11-13T00:20:11+00:00","modified_at":"2026-11-13T00:20:11+00:00","first_seen_at":"2026-11-13T00:41:06+00:00","fetched_at":"2026-11-13T00:41:06+00:00","note":null}],"documents":[{"id":140859,"url":"https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":140860,"url":"https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":140861,"url":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":140862,"url":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-05T17:03:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}