CVE-2026-114603 is a vulnerability in the OpenTelemetry Python package (opentelemetry-api) where the TraceState.from_header method parses the W3C tracestate header using a regular expression with an unbounded optional whitespace run and no length limit. This causes an O(N²) CPU cost when processing long runs of spaces or tabs, leading to significant processing delays and potential denial of service by blocking server workers. The issue affects versions from 0.14.7 up to but not including 0.26.1. A fix is available in version 0.26.1.