Threats tagged 'ghsa-mf5v-w3w3-f6cg'

The OpenTelemetry Python API's TraceContextTextMapPropagator.extract() method is vulnerable to a regular expression denial of service (ReDoS) attack when processing specially crafted traceparent values. Malicious input containing a trace-context prefix followed by a long whitespace sequence and embedded newlines can cause quadratic-time regex backtracking, leading to excessive CPU consumption and request delays. This vulnerability affects versions prior to 1.45.2. The issue does not allow data disclosure, modification, or code execution but can degrade service availability. The vulnerability is mitigated by upgrading to version 1.45.2 or later, which rejects overly long traceparent values and removes problematic regex patterns.