CVE-2026-126360

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.

• CWE-1333

• https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350
• https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939
• https://github.com/open-telemetry/opentelemetry-python/pull/5818
• https://github.com/open-telemetry/opentelemetry-python/pull/5856
• https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2
• https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126354Addressable is an alternative implementation to the URI impl…4.8
• CVE-2026-126355Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126356Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126357Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126358Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126359Hono is a Web application framework that provides support fo…3.4
• CVE-2026-126361Astro is a web framework for content-driven websites. Prior …2.3
• CVE-2026-126362Astro is a web framework for content-driven websites. From 5…2.3
• CVE-2026-126363Astro is a web framework for content-driven websites. From 0…2.3
• CVE-2026-126364Astro is a web framework for content-driven websites. From 5…6.3
• CVE-2026-126365Astro is a web framework for content-driven websites. Prior …5.4
• CVE-2026-126366MessagePack for Ruby is an implementation of the MessagePack…7.5