A regular expression inefficiency in OpenTelemetry Python's TraceState.from_header method causes quadratic CPU time when parsing large tracestate headers with long runs of spaces or tabs. This can lead to significant processing delays and blocking of other connections in asynchronous servers. The issue affects versions from 1.0.0 through 1.45.0 and was fixed in version 0.142.3 of the related fastapi package. The vulnerability allows an unauthenticated attacker to cause denial of service by sending a specially crafted large tracestate header.