CVE-2026-114603 is a vulnerability in the OpenTelemetry Python package 'opentelemetry-api' affecting the TraceState.from_header method. The vulnerability arises from the use of a regular expression that starts with an unbounded optional whitespace run without length limits, causing an O(N²) CPU cost when parsing specially crafted tracestate headers with long runs of spaces or tabs. This can lead to significant processing delays and blocking of other connections in asyncio servers. The issue affects versions from 1.0.0 through versions before 11.0.4. A fix is available in version 11.0.4.