A vulnerability in the OpenTelemetry Python package (opentelemetry-api) affects the TraceState.from_header function, which parses the W3C tracestate header. The parsing uses a regular expression with an unbounded optional-whitespace run and no length limit, causing an O(N²) CPU cost when processing a tracestate header with a long run of spaces or tabs without commas. This can lead to significant CPU consumption and blocking of asyncio servers handling requests. The issue is present in versions from 1.0.0 through 1.45.0 and fixed in version 0.15.7. The vulnerability allows an unauthenticated attacker to cause denial of service by sending a specially crafted large tracestate header.