CVE-2026-126360 OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api
Attackers can send malformed traceparent headers causing quadratic regex backtracking, exhausting CPU on servers using OpenTelemetry Python.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-126360?
CVE-2026-126360 is a medium-severity denial of service vulnerability in open-telemetry opentelemetry-python, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.
Weakness: CWE-1333
Which versions are affected by CVE-2026-126360?
An affected version is exposed as installed. No special setting or call is needed.
How do I fix CVE-2026-126360?
No fix has been published for CVE-2026-126360 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-126360 being exploited?
There is no known exploitation of CVE-2026-126360 in the wild and no public exploit code.
Sources
Also known as GHSA-mf5v-w3w3-f6cg.