{"affected":[{"product":"opentelemetry-python","source":"CNA: GitHub_M","vendor":"open-telemetry","versions":[{"status":"affected","version":"< 1.45.2"}]}],"cveId":"CVE-2026-126360","cwes":["CWE-1333"],"description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1794522262023,"publishedAt":1794522262023,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-python/pull/5818"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-python/pull/5856"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2"}],"remediation":[],"revision":"7bf58283dbfa83c712bd5eb0fc677920d42ecdac7d4e83a90ee7a8db0ee829db","sources":[{"modifiedAt":1794522262023,"name":"CNA: GitHub_M","retrievedAt":1794524926847,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126360"}],"ssvc":null,"status":"published","title":"OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api","updatedAt":1794524926847}