A vulnerability in OpenTelemetry Python's opentelemetry-api package causes quadratic CPU cost when parsing the W3C tracestate header due to an unbounded optional-whitespace regular expression. This can lead to denial of service by blocking server workers for several seconds when processing large tracestate headers with many spaces or tabs. The issue affects versions from 1.0.0 through versions before 3.0.3. A fix is available in version 3.0.3.