CVE-2026-126360: Regular Expression Denial of Service in OpenTelemetry Python opentelemetry-api

OpenTelemetry Python (open-telemetry/opentelemetry-python) provides the standard API and SDK implementations for generating, collecting, and propagating distributed telemetry data in Python applications. A critical function of the opentelemetry-api package is context propagation, which enables distributed traces to correlate spans across process and network boundaries. The TraceContextTextMapPropagator class implements the W3C Trace Context specification, parsing incoming traceparent and tracestate fields from carrier objects on every instrumented incoming request.

Because context extraction occurs at the ingress point of instrumented services, TraceContextTextMapPropagator.extract() is directly exposed to untrusted external input. In versions of opentelemetry-api prior to 1.45.2, the regular expression responsible for validating and tokenizing the traceparent header string contains an algorithmic complexity flaw classified under CWE-1333 (Inefficient Regular Expression Complexity).

When evaluating a specially structured traceparent string that starts with a valid prefix followed by a hyphen, a sequence of whitespace characters, an embedded newline (\n), and at least one trailing character, the Python re engine enters a catastrophic backtracking loop. The evaluation complexity scales quadratically ($O(N^2)$) with the number of whitespace characters in the payload.

In Python runtime environments, CPU-bound regular expression evaluation holds the Global Interpreter Lock (GIL) and blocks the executing OS thread. For applications built on asynchronous frameworks such as FastAPI, Starlette, aiohttp, Quart, or Tornado, context propagation runs synchronously on the main event loop thread. Consequently, processing a single malicious carrier payload blocks the entire event loop, starving all concurrent requests and causing an application-wide Denial of Service (DoS).

The root cause of CVE-2026-126360 lies in the construction of _TRACEPARENT_HEADER_FORMAT within opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py. The W3C Trace Context specification defines traceparent as four hyphen-separated hexadecimal fields: version (2 characters), trace-id (32 characters), parent-id (16 characters), and trace-flags (2 characters). For forward compatibility with higher specification versions, the parser permits optional trailing fields prefixed by a hyphen (-.*), as well as optional leading and trailing whitespace ([ \t]*).

In vulnerable versions, the regular expression combined this optional suffix group directly with the trailing whitespace pattern before the end-of-string anchor: (-.*)?[ \t]*$. This juxtaposition creates two adjacent subpatterns containing unbounded quantifiers (.* and [ \t]*) that can both match horizontal whitespace characters ( and \t).

When re.search() evaluates an input string containing a valid 55-character prefix followed by "-" + (" " * N) + "\nx", the initial four groups match the prefix and the optional group (-.*)? is entered upon encountering the fifth hyphen. Because the . metacharacter in Python's re module matches any character except a newline (\n) by default, the greedy .* quantifier consumes all $N$ space characters up to the embedded \n.

Next, the engine attempts to satisfy [ \t]*$ against the remaining input substring "\nx". While [ \t]* matches zero characters, the $ anchor only matches the end of the string or immediately before a newline at the very end of the string. Because \n is followed by x, the $ assertion fails.

Upon failure at $, the NFA regular expression engine backtracks into (-.*)?. The .* quantifier surrenders one space character, leaving it to be matched by [ \t]*. The engine then re-evaluates $ against "\nx", which fails again. The .* quantifier then surrenders a second space, [ \t]* consumes both surrendered spaces, and $ fails once more. For an input containing $N$ spaces, the engine performs $\sum_{k=1}^{N} k = \frac{N(N + 1)}{2}$ backtracking steps, resulting in $O(N^2)$ time complexity. Furthermore, because extract() lacked any maximum length validation prior to executing re.search(), an attacker could supply arbitrarily large values of $N$.

The vulnerability resides in opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py. Prior to version 1.45.2, TraceContextTextMapPropagator compiled the vulnerable regular expression at class definition time and applied it directly to the first element extracted from the carrier without prior boundary checks:

# Vulnerable implementation (< 1.45.2)
class TraceContextTextMapPropagator(textmap.TextMapPropagator):
 
    _TRACEPARENT_HEADER_NAME = "traceparent"
    _TRACESTATE_HEADER_NAME = "tracestate"
    _TRACEPARENT_HEADER_FORMAT = (
        "^[ \t]*([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})"
        + "(-.*)?[ \t]*$"  # BUG: Overlapping match space between '.*' and '[ \t]*'
    )
    _TRACEPARENT_HEADER_FORMAT_RE = re.compile(_TRACEPARENT_HEADER_FORMAT)
 
    def extract(
        self,
        carrier: textmap.CarrierT,
        context: typing.Optional[context.Context] = None,
        getter: textmap.Getter[textmap.CarrierT] = default_getter,
    ) -> context.Context:
        if context is None:
            context = context_api.get_current()
 
        header = getter.get(carrier, self._TRACEPARENT_HEADER_NAME)
        if not header:
            return context
 
        # BUG: Unbounded input passed directly to regex engine
        match = re.search(self._TRACEPARENT_HEADER_FORMAT_RE, header[0])
        if not match:
            return context

The patch, introduced in commit faa72dae511ae64a7bf8ca63eff9ad4387d0b939 (PR #5818) and backported via commit 78123a2755c907c602e02352aebed4be86aa5350 (PR #5856), resolves the issue through two defense-in-depth modifications:

# Patched implementation (>= 1.45.2)
class TraceContextTextMapPropagator(textmap.TextMapPropagator):
 
    _TRACEPARENT_HEADER_NAME = "traceparent"
    _TRACESTATE_HEADER_NAME = "tracestate"
    _TRACEPARENT_HEADER_FORMAT = (
        "^[ \t]*([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})"
        + "(?:(-.*)|[ \t]*)$"  # FIX 1: Mutually exclusive alternation eliminates backtracking
    )
    _TRACEPARENT_HEADER_FORMAT_RE = re.compile(_TRACEPARENT_HEADER_FORMAT)
    _TRACEPARENT_MAXIMUM_LENGTH = 512  # FIX 2: Hard upper bound on input length
 
    # pylint: disable-next=too-many-return-statements
    def extract(
        self,
        carrier: textmap.CarrierT,
        context: typing.Optional[context.Context] = None,
        getter: textmap.Getter[textmap.CarrierT] = default_getter,
    ) -> context.Context:
        if context is None:
            context = context_api.get_current()
 
        header = getter.get(carrier, self._TRACEPARENT_HEADER_NAME)
        if not header:
            return context
 
        # FIX 2: Reject overly long headers before regex evaluation
        if len(header[0]) > self._TRACEPARENT_MAXIMUM_LENGTH:
            _logger.warning(
                "traceparent header exceeded the maximum length of %d characters",
                self._TRACEPARENT_MAXIMUM_LENGTH,
            )
            return context
 
        match = re.search(self._TRACEPARENT_HEADER_FORMAT_RE, header[0])
        if not match:
            return context

First, the regular expression tail (-.*)?[ \t]*$ was replaced with the non-capturing alternation (?:(-.*)|[ \t]*)$. Under this structure, the engine either matches the hyphen-prefixed suffix (-.*) up to the end of the line, or—if no hyphen is present—matches trailing whitespace [ \t]*. Because the two branches are mutually exclusive and (-.*) is no longer followed by [ \t]*, characters surrendered by .* during backtracking have no subsequent subpattern to match against, reducing evaluation to linear time $O(N)$.

Second, the patch enforces a strict maximum length check (_TRACEPARENT_MAXIMUM_LENGTH = 512) prior to calling re.search(). Note that for version 00 headers, trailing characters matched by (-.*) are subsequently rejected by post-regex validation checks in extract() (if version == "00" and match.group(5): return context), whereas higher versions allow suffixes containing trailing spaces. Both the structural regex fix and the 512-character ceiling completely eliminate the quadratic complexity vector.

Exploiting CVE-2026-126360 requires delivering a traceparent value to TraceContextTextMapPropagator.extract() that satisfies three structural conditions:

1. A valid 55-character prefix matching ^[ \t]*([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2}) followed immediately by a hyphen (-).
2. A long contiguous sequence of space (0x20) or horizontal tab (0x09) characters.
3. An embedded linefeed (\n, 0x0A) followed by at least one non-matching character (e.g., x).

A key architectural nuance of exploitation involves the transport carrier. Standard HTTP/1.1 and HTTP/2 gateways, load balancers, and WSGI/ASGI servers strictly enforce RFC 9110 (and RFC 7230) header syntax, which forbids raw newline (\n) bytes inside HTTP header values. Consequently, attempts to exploit this flaw over standard HTTP headers will normally be rejected at the HTTP parsing layer before reaching OpenTelemetry instrumentation.

However, TraceContextTextMapPropagator is transport-agnostic and extracts context from arbitrary Python dictionary mappings (CarrierT). Exploitation is directly viable across protocols and serialization formats that preserve newline characters inside string values:

• JSON-based Carriers & Model Context Protocol (MCP): Systems passing trace context inside JSON request bodies or JSON-RPC metadata fields (such as AI/LLM agents and tool servers communicating via MCP) decode escaped \n sequences into literal newline characters in Python memory prior to calling extract().
• Message Brokers & Task Queues: Asynchronous workers consuming messages from Apache Kafka, RabbitMQ (AMQP), Celery, or MQTT extract trace context from message header dictionaries or payload properties that permit arbitrary UTF-8 strings containing linefeeds.
• Custom RPC / gRPC Metadata: Internal microservices exchanging unvalidated metadata maps.

The following proof-of-concept demonstrates the quadratic execution time degradation in opentelemetry-api < 1.45.2:

import time
from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator
 
propagator = TraceContextTextMapPropagator()
 
# 1. Construct a valid 55-character W3C traceparent prefix
valid_prefix = "01-12345678901234567890123456789012-1234567890123456-01"
 
# 2. Append hyphen, 50,000 spaces, newline, and trailing character
payload_length = 50000
malformed_traceparent = valid_prefix + "-" + (" " * payload_length) + "\nx"
 
carrier = {
    "traceparent": malformed_traceparent
}
 
# 3. Trigger extraction and measure execution time
start_time = time.perf_counter()
propagator.extract(carrier)
elapsed = time.perf_counter() - start_time
 
print(f"Extraction completed in: {elapsed:.4f} seconds")

> [!NOTE] > Doubling payload_length from 50,000 to 100,000 quadruples the CPU processing time required for a single extract() call, allowing a lightweight ~100 KB payload to pin a CPU core for several seconds.

CVE-2026-126360 is rated Medium severity with a CVSS v3.1 base score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). The attack vector is Network (AV:N) with Low attack complexity (AC:L), requiring neither privileges (PR:N) nor user interaction (UI:N). Because the vulnerability is strictly an algorithmic resource exhaustion flaw, Confidentiality (C:N) and Integrity (I:N) are unaffected.

The primary operational impact is Availability degradation (A:L). In Python, the re engine executes in C without releasing the Global Interpreter Lock (GIL) during single pattern match evaluations. In multi-threaded WSGI servers (such as Gunicorn sync/threaded workers), each malicious request monopolizes one worker thread and blocks other threads within the same process from executing Python bytecode while the GIL is held.

The impact is amplified in asynchronous Python servers (such as Uvicorn running FastAPI or Starlette, or aiohttp services) and single-threaded message consumers. Because TraceContextTextMapPropagator.extract() runs synchronously inside middleware or message handler callbacks on the main asyncio event loop, blocking that thread halts all concurrent I/O multiplexing, health check responses, and request handling for the duration of the regular expression evaluation. Sustained transmission of crafted payloads at a low request rate is sufficient to render the target service unresponsive and trigger container liveness probe failures.

As of November 2026, the Exploit Prediction Scoring System (EPSS) assigns CVE-2026-126360 a score of 0.00519 (0.52% probability of exploitation within 30 days, 44.64th percentile), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

To remediate CVE-2026-126360, upgrade the opentelemetry-api package to version 1.45.2 or later (or 0.66b2 for prerelease instrumentation tracks). Version 1.45.2 enforces a 512-character ceiling on traceparent headers and eliminates the backtracking regular expression pattern.

Update the dependency using pip:

pip install --upgrade "opentelemetry-api>=1.45.2"

Ensure that dependency lockfiles (requirements.txt, poetry.lock, Pipfile.lock, or uv.lock) are updated and container images are rebuilt to incorporate the patched package:

opentelemetry-api>=1.45.2
opentelemetry-sdk>=1.45.2

For environments where an immediate dependency upgrade is restricted by version constraints, apply an application-level workaround by sanitizing carrier dictionaries or wrapping the custom Getter passed to extract() to reject traceparent strings exceeding 512 bytes or containing line break characters (\n or \r):

from opentelemetry.propagate import get_global_textmap
 
def safe_extract(carrier: dict):
    tp = carrier.get("traceparent")
    if isinstance(tp, str) and (len(tp) > 512 or "\n" in tp or "\r" in tp):
        carrier = carrier.copy()
        carrier.pop("traceparent", None)
    elif isinstance(tp, list) and tp and (len(tp[0]) > 512 or "\n" in tp[0] or "\r" in tp[0]):
        carrier = carrier.copy()
        carrier.pop("traceparent", None)
    return get_global_textmap().extract(carrier)

Additionally, organizations exposing JSON-RPC, Model Context Protocol (MCP), or message queue consumers to untrusted producers should enforce strict schema validation at API gateways and ingestion boundaries, restricting traceparent fields to a maximum length of 512 ASCII characters and rejecting control characters (0x00–0x1F).