Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: <= 1.45.1
Patched in 1.45.2
Details
TraceContextTextMapPropagator.extract() in opentelemetry-api is vulnerable to regular expression denial of service (ReDoS) when processing a specially crafted traceparent value.
A malformed value containing a trace-context prefix followed by a long whitespace sequence and an embedded newline triggers quadratic-time regex backtracking. Applications that extract trace context from untrusted carriers accepting such strings can experience excessive CPU consumption and request-processing delays.
When extraction runs on an asynchronous server’s event-loop thread, a single malicious message can delay unrelated requests handled by that event loop.
Exploitation requires attacker-controlled input to reach the affected propagator through a carrier that preserves embedded newlines and permits a sufficiently large value.
Conforming HTTP header values cannot contain embedded newlines. However, OpenTelemetry carriers are not restricted to HTTP headers. JSON strings can contain escaped newlines that become newline characters after decoding.
MCP request metadata is one relevant integration path: applications may extract trace context from JSON params._meta. Exposure depends on the MCP SDK or instrumentation version, whether extraction invokes the W3C Trace Context propagator, and applicable message-size limits. HTTP header validation does not constrain a traceparent string carried inside a JSON body.
Authentication requirements depend on the application exposing the carrier.
The demonstrated impact is denial of service through excessive CPU consumption and blocked request processing. Repeated malicious messages may sustain service degradation.
This finding does not demonstrate data disclosure, data modification, or code execution.
Upgrade opentelemetry-api to 1.45.2 or a later release containing the fix.
Version 1.45.2 rejects traceparent values longer than 512 characters before regex matching and removes the overlapping suffix and trailing-whitespace expressions.
Where upgrading is temporarily unavailable, reject oversized values and embedded CR/LF characters before passing untrusted trace-context values to the affected propagator.
EPSS, exploit probability
Low0.52%
estimated chance of real-world exploitation in the next 30 days, higher than 44.6% of every CVE FIRST.org scores
Refreshed 11/14/2026, via FIRST.org's EPSS model, not CVSS, this measures likelihood of exploitation, not how severe it would be.
More pip advisories
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.