---
id: "CVE-2026-126360"
page: "https://infrastack.ai/live/CVE-2026-126360"
kind: "vulnerability"
aliases: ["CVE-2026-126360"]
title: "OpenTelemetry Python API: crafted traceparent header stalls request handling"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["async-servers", "mcp", "opentelemetry", "package", "python"]
not_affected_if: ["http-headers-only", "no-incoming-trace-context"]
published_at: "2026-11-13T00:20:11+00:00"
first_seen_at: "2026-11-13T00:41:06+00:00"
updated_at: "2026-11-13T00:41:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126360", "first_seen_at": "2026-11-13T00:41:06+00:00"}]
exploit_sources: []
---

# OpenTelemetry Python API: crafted traceparent header stalls request handling

Link for people: https://infrastack.ai/live/CVE-2026-126360 (this .md is for agents)

The OpenTelemetry Python API's trace-context parser backtracks quadratically on a malformed traceparent value containing a long whitespace run and an embedded newline. An attacker can use this to consume CPU and delay unrelated requests on an asynchronous server's event loop, without disclosure or code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `opentelemetry-api` version with `pip show opentelemetry-api` and compare it to the fixed version.
- Look for services that parse traceparent from JSON-based carriers or MCP request metadata with newlines preserved.

## Fix

- `opentelemetry-api` (Python): `1.45.2`

## Timeline

- 2026-11-13T00:41:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126360

## Documents

- [advisory] Vendor advisory: github.com https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg
- [fix] Patch: github.com https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350
- [fix] Patch: github.com https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939
- [fix] Release notes: github.com https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2

## From the sources

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_