[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
opentelemetry-api	1.45.1 → 1.45.2

---

OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing

CVE-2026-126360 / GHSA-mf5v-w3w3-f6cg

More information

Details

Summary

TraceContextTextMapPropagator.extract() in opentelemetry-api is vulnerable to regular expression denial of service (ReDoS) when processing a specially crafted traceparent value.

A malformed value containing a trace-context prefix followed by a long whitespace sequence and an embedded newline triggers quadratic-time regex backtracking. Applications that extract trace context from untrusted carriers accepting such strings can experience excessive CPU consumption and request-processing delays.

When extraction runs on an asynchronous server’s event-loop thread, a single malicious message can delay unrelated requests handled by that event loop.

Exposure conditions

Exploitation requires attacker-controlled input to reach the affected propagator through a carrier that preserves embedded newlines and permits a sufficiently large value.

Conforming HTTP header values cannot contain embedded newlines. However, OpenTelemetry carriers are not restricted to HTTP headers. JSON strings can contain escaped newlines that become newline characters after decoding.

MCP request metadata is one relevant integration path: applications may extract trace context from JSON params._meta. Exposure depends on the MCP SDK or instrumentation version, whether extraction invokes the W3C Trace Context propagator, and applicable message-size limits. HTTP header validation does not constrain a traceparent string carried inside a JSON body.

Authentication requirements depend on the application exposing the carrier.

Impact

The demonstrated impact is denial of service through excessive CPU consumption and blocked request processing. Repeated malicious messages may sustain service degradation.

This finding does not demonstrate data disclosure, data modification, or code execution.

Remediation

Upgrade opentelemetry-api to 1.45.2 or a later release containing the fix.

Version 1.45.2 rejects traceparent values longer than 512 characters before regex matching and removes the overlapping suffix and trailing-whitespace expressions.

Where upgrading is temporarily unavailable, reject oversized values and embedded CR/LF characters before passing untrusted trace-context values to the affected propagator.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg
• https://nvd.nist.gov/vuln/detail/CVE-2026-126360
• https://github.com/open-telemetry/opentelemetry-python/pull/5818
• https://github.com/open-telemetry/opentelemetry-python/pull/5856
• https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350
• https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939
• https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2
• https://github.com/advisories/GHSA-mf5v-w3w3-f6cg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-python (opentelemetry-api)

v1.45.2

Compare Source

Added

• opentelemetry-sdk, opentelemetry-configuration,
  opentelemetry-exporter-prometheus: enforce metric cardinality limits
  (default 2000) with the otel.metric.overflow attribute, configurable
  through View(aggregation_cardinality_limit=...), reader
  cardinality_limits and declarative configuration
  (#​5809)

Fixed

• opentelemetry-api: limit traceparent header length to 512 characters in
  TraceContextTextMapPropagator during extraction
  (#​5818)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.