CVE-2026-114603: CWE-400: Uncontrolled Resource Consumption in open-telemetry opentelemetry-python

In opentelemetry-python versions before 1.45.1, the TraceState.from_header function, accessed via TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regex. A malformed header containing a long run of spaces or tabs without a following comma triggers quadratic backtracking before the member-count limit is enforced. This results in excessive CPU consumption on processing a single unauthenticated request, potentially occupying synchronous workers or delaying unrelated requests on the same asynchronous event loop. The vulnerability affects availability only and does not compromise telemetry data integrity or confidentiality. The issue is resolved in version 1.45.1.

The vulnerability can cause denial of service by consuming excessive CPU resources when processing specially crafted malformed tracestate headers. This may delay or block other requests handled by the same server process or event loop. There is no impact on confidentiality or integrity of telemetry data, and no code execution is possible through this flaw.

Upgrade opentelemetry-python to version 1.45.1 or later, where this issue is fixed. No other mitigation is required as the vendor has provided an official fix.