A regular expression used in the OpenTelemetry Python API's TraceState.from_header method causes quadratic CPU time complexity when parsing specially crafted tracestate headers with long runs of spaces or tabs. This can lead to denial of service by blocking the handling worker for several seconds on a single unauthenticated request. The issue affects versions from 1.0.0 through at least v1.45.0 and is fixed in version 5.14.0_18.