Detections
Analytics
SCA: security update for opentelemetry-api (GHSA-xcq7-p3pf-p88h)
medium Tenable Cloud Security Plugin ID 476865
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the
opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through
TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-
whitespace regular expression. A malformed header containing a long run of spaces or tabs without a
following comma causes quadratic backtracking before the member-count limit is applied. Services using the
default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request
when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The
processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event
loop. The impact is limited to availability and does not expose or modify telemetry data or allow code
execution. This issue is fixed in version 1.45.1. (CVE-2026-114603)
Solution
Update the opentelemetry-api library and its related packages to version 1.45.1 or later.See Also
Plugin Details
Severity: Medium
ID: 476865
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/22/2026
Updated: 10/22/2026
Risk Information
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2026-114603
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/22/2026
Vulnerability Publication Date: 10/22/2026
Reference Information
CVE: CVE-2026-114603