CVE-2026-114603 is a vulnerability in the OpenTelemetry Python package opentelemetry-api affecting the TraceState.from_header method. The vulnerability arises from an unbounded regular expression that parses the W3C tracestate header, leading to quadratic CPU time complexity when processing long runs of spaces or tabs without commas. This can cause denial-of-service by blocking the handling worker for several seconds on a single unauthenticated request with a large tracestate header. The issue affects versions from 1.0.0 through at least v1.45.0 and is fixed in version 4.5.1_15. The vulnerability does not impact confidentiality or integrity but causes availability degradation due to CPU exhaustion.