1 line
4.7 KiB
JSON
1 line
4.7 KiB
JSON
{"schema_version":"1.9.2","id":"GHSA-mf5v-w3w3-f6cg","published":"2026-11-13T16:43:18Z","modified":"2026-11-13T17:00:03.925479166Z","aliases":["CVE-2026-126360"],"summary":"OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing","details":"## Summary\n\n`TraceContextTextMapPropagator.extract()` in `opentelemetry-api` is vulnerable to regular expression denial of service (ReDoS) when processing a specially crafted `traceparent` value.\n\nA malformed value containing a trace-context prefix followed by a long whitespace sequence and an embedded newline triggers quadratic-time regex backtracking. Applications that extract trace context from untrusted carriers accepting such strings can experience excessive CPU consumption and request-processing delays.\n\nWhen extraction runs on an asynchronous server’s event-loop thread, a single malicious message can delay unrelated requests handled by that event loop.\n\n## Exposure conditions\n\nExploitation requires attacker-controlled input to reach the affected propagator through a carrier that preserves embedded newlines and permits a sufficiently large value.\n\nConforming HTTP header values cannot contain embedded newlines. However, OpenTelemetry carriers are not restricted to HTTP headers. JSON strings can contain escaped newlines that become newline characters after decoding.\n\nMCP request metadata is one relevant integration path: applications may extract trace context from JSON `params._meta`. Exposure depends on the MCP SDK or instrumentation version, whether extraction invokes the W3C Trace Context propagator, and applicable message-size limits. HTTP header validation does not constrain a `traceparent` string carried inside a JSON body.\n\nAuthentication requirements depend on the application exposing the carrier.\n\n## Impact\n\nThe demonstrated impact is denial of service through excessive CPU consumption and blocked request processing. Repeated malicious messages may sustain service degradation.\n\nThis finding does not demonstrate data disclosure, data modification, or code execution.\n\n## Remediation\n\nUpgrade `opentelemetry-api` to `1.45.2` or a later release containing the fix.\n\nVersion `1.45.2` rejects `traceparent` values longer than 512 characters before regex matching and removes the overlapping suffix and trailing-whitespace expressions.\n\nWhere upgrading is temporarily unavailable, reject oversized values and embedded CR/LF characters before passing untrusted trace-context values to the affected propagator.","affected":[{"package":{"name":"opentelemetry-api","ecosystem":"PyPI","purl":"pkg:pypi/opentelemetry-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.45.2"}]}],"versions":["0.10b0","0.11b0","0.12b0","0.13b0","0.14b0","0.15b0","0.16b0","0.16b1","0.17b0","0.1a0","0.2a0","0.3a0","0.4a0","0.4a1","0.5b0","0.6b0","0.7b0","0.7b1","0.8b0","0.9b0","1.0.0","1.0.0rc1","1.1.0","1.10.0","1.10a0","1.11.0","1.11.1","1.12.0","1.12.0rc1","1.12.0rc2","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.25.0","1.26.0","1.27.0","1.28.0","1.28.1","1.28.2","1.29.0","1.3.0","1.30.0","1.31.0","1.31.1","1.32.0","1.32.1","1.33.0","1.33.1","1.34.0","1.34.1","1.35.0","1.36.0","1.37.0","1.38.0","1.39.0","1.39.1","1.4.0","1.4.1","1.40.0","1.41.0","1.41.1","1.42.0","1.42.1","1.43.0","1.44.0","1.45.0","1.45.1","1.5.0","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.8.0","1.9.0","1.9.1"],"database_specific":{"last_known_affected_version_range":"<= 1.45.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mf5v-w3w3-f6cg/GHSA-mf5v-w3w3-f6cg.json"}}],"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126360"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/pull/5818"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/pull/5856"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939"},{"type":"PACKAGE","url":"https://github.com/open-telemetry/opentelemetry-python"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-13T16:43:18Z","nvd_published_at":"2026-11-13T00:20:11Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]} |