CVE-2026-114603: OpenTelemetry Python DOS Vulnerability

CVE-2026-114603 Overview

CVE-2026-114603 is a regular expression denial of service (ReDoS) vulnerability in OpenTelemetry Python versions prior to 1.45.1. The flaw resides in the TraceState.from_header function in opentelemetry/trace/span.py, which is reached through TraceContextTextMapPropagator.extract. The parser uses an unbounded optional-whitespace regular expression against inbound W3C tracestate headers. A malformed header containing a long run of spaces or tabs without a trailing comma triggers quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can consume excessive CPU time on a single unauthenticated request.

Critical Impact
An unauthenticated attacker can send a single crafted tracestate HTTP header to exhaust CPU on a synchronous worker or stall an asynchronous event loop, degrading service availability.

Affected Products

OpenTelemetry Python opentelemetry-api versions prior to 1.45.1
Services using the default W3C Trace Context propagator (TraceContextTextMapPropagator)
Any HTTP server, parser, gateway, or custom carrier that accepts large tracestate headers and feeds them into OpenTelemetry Python

Discovery Timeline

2026-10-22 - CVE-2026-114603 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114603

Vulnerability Analysis

The vulnerability is a classic algorithmic complexity flaw [CWE-400] in the W3C Trace Context propagator. The TraceState.from_header function parses the tracestate HTTP header using a regular expression that allows unbounded optional whitespace between list members. When the regex encounters a long run of spaces or tabs that is not followed by a comma, the engine performs quadratic backtracking as it attempts to find a valid member boundary. Because this parsing occurs before the member-count limit check, the limit does not short-circuit the pathological input.

The impact is confined to availability. The flaw does not expose or modify telemetry data and does not permit code execution. In synchronous Python servers such as those using gunicorn with sync workers, the request occupies a worker process for the duration of the regex evaluation. In asynchronous frameworks such as asyncio, FastAPI, or aiohttp, the CPU-bound regex blocks the event loop and delays all co-scheduled requests.

Root Cause

The root cause is an unbounded optional-whitespace quantifier in the tracestate parsing regex within opentelemetry/trace/span.py. The regex permits ambiguous matches across whitespace runs, producing exponential alternatives for the backtracking engine. The member-count validation that would normally bound work occurs after the regex has already consumed CPU cycles.

Attack Vector

An attacker sends a single HTTP request containing a malicious tracestate header filled with a long sequence of spaces or tabs and no comma delimiter. No authentication is required. Any public-facing service that extracts W3C Trace Context from incoming requests is reachable. The attack scales linearly: more requests multiply CPU exhaustion across workers.

python

# Patch excerpt - opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py
# Source: https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b

+import logging
 import re

 from opentelemetry import trace
 from opentelemetry.context.context import Context
 from opentelemetry.propagators import textmap
 from opentelemetry.trace import format_span_id, format_trace_id
-from opentelemetry.trace.span import TraceState
+from opentelemetry.trace.span import (
+    _TRACECONTEXT_MAXIMUM_TRACESTATE_LENGTH,
+    TraceState,
+)
+
+_logger = logging.getLogger(__name__)


 class TraceContextTextMapPropagator(textmap.TextMapPropagator):

The fix imports _TRACECONTEXT_MAXIMUM_TRACESTATE_LENGTH and enforces a length cap before invoking the vulnerable parser, preventing the pathological regex path. See the OpenTelemetry Python Commit and Pull Request #5749.

Detection Methods for CVE-2026-114603

Indicators of Compromise

Inbound HTTP requests carrying tracestate headers that exceed several kilobytes or contain long runs of whitespace characters without comma separators.
Sustained CPU spikes on application workers correlated with low request volume on tracing-enabled endpoints.
Request latency outliers or worker timeouts tied to specific client IPs sending repeated malformed tracestate values.

Detection Strategies

Inspect reverse proxy and web server logs for tracestate header length anomalies and reject or alert on values beyond the W3C recommended 512 bytes.
Deploy WAF or API gateway rules that match tracestate headers containing excessive whitespace runs or missing comma delimiters.
Correlate per-worker CPU time metrics with request IDs to identify requests consuming disproportionate processing time inside TraceState.from_header.

Monitoring Recommendations

Track p99 latency and CPU utilization on services instrumented with OpenTelemetry Python and alert on deviations tied to trace propagation handlers.
Enable structured logging of header sizes at ingress proxies and forward them to a centralized analytics platform for anomaly detection.
Monitor the opentelemetry-api package version across deployed services and flag any instance below 1.45.1.

How to Mitigate CVE-2026-114603

Immediate Actions Required

Upgrade opentelemetry-api to version 1.45.1 or later across all Python services.
Audit container images, CI pipelines, and dependency lockfiles (requirements.txt, poetry.lock, Pipfile.lock) for pinned vulnerable versions.
Restart application workers after upgrade to ensure the patched module is loaded.

Patch Information

The fix is included in opentelemetry-python release 1.45.1, published 2026-10-06. The patched parser enforces _TRACECONTEXT_MAXIMUM_TRACESTATE_LENGTH before regex evaluation and improves the regex to eliminate quadratic backtracking. Reference the OpenTelemetry Python Release v1.45.1, the Security Advisory GHSA-xcq7-p3pf-p88h, and the Changelog entry.

Workarounds

Configure the ingress reverse proxy (nginx, Envoy, HAProxy) to drop or truncate tracestate headers larger than 512 bytes, matching the W3C specification limit.
Replace the default TraceContextTextMapPropagator with a custom propagator that validates and length-caps the tracestate header before invoking the parser.
Where tracing propagation is not required, disable the W3C Trace Context propagator entirely until the upgrade is deployed.

bash

# nginx example: cap tracestate header size at the edge
# Add to the server or location block fronting the OpenTelemetry-instrumented service
if ($http_tracestate ~* "^.{513,}$") {
    return 400;
}

# Upgrade the vulnerable package
pip install --upgrade "opentelemetry-api>=1.45.1"