OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the     opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through     TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-     whitespace regular expression. A malformed header containing a long run of spaces or tabs without a     following comma causes quadratic backtracking before the member-count limit is applied. Services using the     default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request     when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The     processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event     loop. The impact is limited to availability and does not expose or modify telemetry data or allow code     execution. This issue is fixed in version 1.45.1. (CVE-2026-114603)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the
    opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through
    TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-
    whitespace regular expression. A malformed header containing a long run of spaces or tabs without a
    following comma causes quadratic backtracking before the member-count limit is applied. Services using the
    default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request
    when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The
    processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event
    loop. The impact is limited to availability and does not expose or modify telemetry data or allow code
    execution. This issue is fixed in version 1.45.1. (CVE-2026-114603)

ID	Name	Product	Family	Type	Severity
371635	Linux Distros Unpatched Vulnerability : CVE-2026-114603	Nessus	Misc.	Local	medium
477150	Chainguard: py3.10-opentelemetry-semantic-conventions-ai: security update to 0.5.1-r2	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
477150	Chainguard: py3.10-opentelemetry-semantic-conventions-ai: security update to 0.5.1-r2	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
476865	SCA: security update for opentelemetry-api (GHSA-xcq7-p3pf-p88h)	Tenable Cloud Security	SCA Checks	Local	medium
476865	SCA: security update for opentelemetry-api (GHSA-xcq7-p3pf-p88h)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-114603

medium

Tenable Plugins

medium

medium

medium

medium

medium