CVE-2026-114603 open-telemetry CVE debrief

Who should care

Defenders who use the opentelemetry-api package in their environments should prioritize patching or mitigating this vulnerability. This includes ensuring that the package is updated to version 1.45.1 or later, and that the `OTEL_PROPAGATORS` environment variable is set to a secure value.

Why it matters

This vulnerability can lead to high CPU usage and potential denial-of-service attacks, making it a significant concern for defenders who use the opentelemetry-api package in their environments.

• Denial-of-service attacks due to high CPU usage
• Potential performance degradation due to increased latency

Technical summary

The `TraceState.from_header` function in the opentelemetry-api package splits the inbound W3C `tracestate` header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. This can lead to high CPU usage and potential denial-of-service attacks. A single unauthenticated request with a large `tracestate` header can keep the handling worker busy for several seconds. The issue was introduced in version 1.0.0 of the opentelemetry-api package and was fixed in version 1.45.1. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where the opentelemetry-api package is used.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where the opentelemetry-api package is used. This can be done by updating to version 1.45.1 or later, and ensuring that the `OTEL_PROPAGATORS` environment variable is set to a secure value.

Recommended defensive actions

• Update to version 1.45.1 or later of the opentelemetry-api package
• Ensure that the `OTEL_PROPAGATORS` environment variable is set to a secure value
• Monitor for potential denial-of-service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was introduced in version 1.0.0 of the opentelemetry-api package and was fixed in version 1.45.1. The issue can be triggered by a single unauthenticated request with a large `tracestate` header, which can keep the handling worker busy for several seconds.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.