OpenTelemetry Python EUVD-2026-108216

Exploitation requires a service using the default W3C Trace Context propagator (OTEL_PROPAGATORS defaults to tracecontext,baggage) with server instrumentation that calls propagate.extract(), such as opentelemetry-instrumentation-asgi, running opentelemetry-api <= 1.45.0. The decisive limiting factor is the fronting HTTP server/parser's header-size handling: the attack only lands where headers larger than roughly 16-30 KB are accepted. Per the advisory's testing, gunicorn rejects headers >= 8190 bytes (431) and uvicorn --http h11 rejects above 16 KiB (400), both of which neutralize the attack, whereas waitress (up to ~256 KiB) and the default uvicorn[standard] httptools parser (accepted 300 KB to 20 MB) let it through. Impact is worst on asyncio servers, where blocking the event loop stalls all concurrent connections. No authentication or user interaction is required.

This is a genuine but moderate-priority availability issue, not a false-positive high-CVSS artifact - the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3 Medium) correctly reflects a remote, unauthenticated, low-complexity flaw with availability-only impact and no confidentiality or integrity effect; the advisory explicitly states it does not expose or modify telemetry and does not allow code execution, so the 'RCE' input tag is contradicted by the primary evidence. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a Medium severity rather than drop-everything urgency. No CISA KEV listing and no EPSS score were supplied, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified' in KEV terms, but a complete, measured proof-of-concept IS included in the GHSA advisory, so the issue is fully reproducible. One nuance worth flagging: the CVSS base score uses A:L (partial availability), yet the advisory shows a single ~100 KB request can stall an entire asyncio event loop for 6-12 seconds and that repeating it keeps the service unavailable, which operationally trends toward higher availability impact than A:L implies - verify against your own deployment's concurrency model. Real-world risk is materially gated by HTTP-layer header-size limits (see exploitation_conditions), which prevents this from being a universally trivial DoS despite PR:N/AC:L.

An unauthenticated attacker sends a single HTTP request carrying a valid traceparent and a malicious tracestate header consisting of a valid member followed by a long run (~100 KB) of spaces or tabs with no trailing comma. A server using the default W3C Trace Context propagator parses it via TraceContextTextMapPropagator.extract, triggering O(N²) regex backtracking that consumes 6-12 seconds of CPU on one request and, under an asyncio server such as uvicorn with httptools, blocks every other connection for that duration. A functional proof-of-concept demonstrating both the quadratic cost and the server stall is published in the GHSA advisory.