CVE-2026-126360: Regular Expression Denial of Service in OpenTelemetry Python opentelemetry-api

Vulnerability ID: CVE-2026-126360
CVSS Score: 5.3
Published: 2026-11-13

CVE-2026-126360 (GHSA-mf5v-w3w3-f6cg) is an algorithmic complexity vulnerability (Regular Expression Denial of Service) in the trace context propagation logic of the opentelemetry-api package within the OpenTelemetry Python ecosystem. In versions prior to 1.45.2, the TraceContextTextMapPropagator.extract() method utilizes a regular expression susceptible to quadratic-time backtracking when parsing malformed W3C traceparent headers containing long sequences of whitespace followed by an embedded newline character. In Python applications—particularly those using single-threaded asynchronous event loops—an unauthenticated remote attacker transmitting payloads over newline-preserving carriers can monopolize CPU execution and induce application-level Denial of Service.

TL;DR

An inefficient regular expression in opentelemetry-api prior to version 1.45.2 allows unauthenticated attackers to trigger quadratic-time CPU exhaustion via crafted W3C traceparent headers containing trailing spaces and embedded newlines.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Type: Regular Expression Denial of Service (ReDoS)
• CWE Classification: CWE-1333: Inefficient Regular Expression Complexity
• CVSS v3.1 Score: 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
• EPSS Score: 0.52% (44.64th Percentile)
• Affected Component: opentelemetry-api (< 1.45.2) TraceContextTextMapPropagator
• Patched Version: opentelemetry-api 1.45.2
• Exploit Status: Proof-of-Concept (PoC) Available
• CISA KEV Status: Not Listed

Affected Systems

• OpenTelemetry Python API (opentelemetry-api)
• Python web applications and microservices using TraceContextTextMapPropagator
• Model Context Protocol (MCP) servers and JSON-RPC services instrumented with OpenTelemetry Python
• Asynchronous Python worker queues (Kafka, RabbitMQ, Celery) extracting W3C Trace Context
• opentelemetry-api: < 1.45.2 (Fixed in: 1.45.2)

Code Analysis

Commit: faa72da

Primary fix commit in PR #5818 restructuring the traceparent regex to use non-capturing alternation and adding a 512-character maximum length check.

File: opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py
@@ -21,9 +21,13 @@ class TraceContextTextMapPropagator(textmap.TextMapPropagator):

     _TRACEPARENT_HEADER_NAME = "traceparent"
     _TRACESTATE_HEADER_NAME = "tracestate"
-    _TRACEPARENT_HEADER_FORMAT = "^[ \t]*([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})" + "(-.*)?[ \t]*$"
+    _TRACEPARENT_HEADER_FORMAT = (
+        "^[ \t]*([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})" + "(?:(-.*)|[ \t]*)$"
+    )
     _TRACEPARENT_HEADER_FORMAT_RE = re.compile(_TRACEPARENT_HEADER_FORMAT)
+    _TRACEPARENT_MAXIMUM_LENGTH = 512

+    # pylint: disable-next=too-many-return-statements
     def extract(
         self,
         carrier: textmap.CarrierT,
@@ -42,6 +46,13 @@ def extract(
         if not header:
             return context

+        if len(header[0]) > self._TRACEPARENT_MAXIMUM_LENGTH:
+            _logger.warning(
+                "traceparent header exceeded the maximum length of %d characters",
+                self._TRACEPARENT_MAXIMUM_LENGTH,
+            )
+            return context
+
         match = re.search(self._TRACEPARENT_HEADER_FORMAT_RE, header[0])
         if not match:
             return context

Commit: 78123a2

Backport commit (PR #5856) applying the traceparent parsing fix to the release/v1.45.x-0.66bx branch.

Exploit Details

• GitHub Security Advisory: Official GitHub Security Advisory detailing the quadratic-time ReDoS mechanism and carrier requirements.
• GitHub Pull Request #5818: Official patch PR containing regression unit tests demonstrating malformed traceparent inputs with trailing spaces and newlines.

Mitigation Strategies

• Upgrade opentelemetry-api to version 1.45.2 or later to enforce linear-time regular expression evaluation and strict header length bounds.
• Implement input validation on non-HTTP carriers (such as JSON bodies, MCP metadata, and message queue headers) to reject traceparent strings exceeding 512 characters.
• Filter or strip embedded newline (\n) and carriage return (\r) characters from distributed tracing carrier fields before invoking propagator extraction.
• Deploy WAF rules or API gateway schema constraints to block JSON payloads containing oversized or newline-embedded traceparent fields.

Remediation Steps:

1. Audit Python environments and dependency lockfiles for opentelemetry-api versions prior to 1.45.2.
2. Run 'pip install --upgrade "opentelemetry-api>=1.45.2"' across affected virtual environments and container build pipelines.
3. Verify the installed package version using 'pip show opentelemetry-api'.
4. If immediate upgrading is blocked, wrap carrier extraction logic to drop traceparent values where len(value) > 512 or '\n' in value.

References

• GitHub Security Advisory: GHSA-mf5v-w3w3-f6cg
• Official CVE Record: CVE-2026-126360
• National Vulnerability Database: CVE-2026-126360
• Pull Request #5818: Traceparent parsing refinement
• Pull Request #5856: v1.45.x Backport
• Fix Commit (Core): faa72dae511ae64a7bf8ca63eff9ad4387d0b939
• Fix Commit (Backport): 78123a2755c907c602e02352aebed4be86aa5350
• OpenTelemetry Python Release v1.45.2
• CVE List v5 Repository Record: CVE-2026-126360

Read the full report for CVE-2026-126360 on our website for more details including interactive diagrams and full exploit analysis.