Opentelemetry Python
Monthly
Unbounded baggage processing in the optional OpenTelemetry Python Jaeger propagator (opentelemetry-propagator-jaeger before 1.45.0) lets a remote sender force unnecessary CPU work and short-lived heap allocations by supplying a carrier with numerous or oversized uberctx-* entries, degrading availability of the receiving service. According to the CVSS vector, no authentication is required (PR:N), but exploitation depends on specific deployment conditions (AT:P): the separately installed Jaeger propagator must be explicitly enabled - it is not part of the default OpenTelemetry Python configuration - and the service must accept untrusted inbound propagation headers. Practical impact is modest because common Python servers cap request headers before they reach the propagator (Gunicorn defaults to 100 header fields and 8,190 bytes per field; Uvicorn/h11 buffers incomplete events at 16,384 bytes), with materially higher exposure for non-HTTP transports, custom TextMapGetter implementations, or deployments that have raised or disabled server and gateway limits. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.45.0.
Denial of service in OpenTelemetry Python (opentelemetry-api through 1.45.0) lets a single unauthenticated request carrying an oversized W3C tracestate header burn roughly 6-12 seconds of CPU, and on asyncio servers stall every other connection on the event loop for that duration. The flaw is a quadratic-time regex split in TraceState.from_header that is reached automatically through the default tracecontext propagator, so any service instrumented with something like opentelemetry-instrumentation-asgi is affected without special configuration; exploitation is gated by the fronting HTTP parser's header-size limit, with gunicorn and uvicorn's h11 parser rejecting the header while waitress and uvicorn's default httptools parser accept it. A working proof-of-concept with measured timings is included in the upstream advisory (public PoC reference), but no confirmed active exploitation (CISA KEV) is indicated in the supplied intelligence, and the assessed CVSS of 5.3 reflects availability-only impact (C:N/I:N/A:L).
Unbounded baggage processing in the optional OpenTelemetry Python Jaeger propagator (opentelemetry-propagator-jaeger before 1.45.0) lets a remote sender force unnecessary CPU work and short-lived heap allocations by supplying a carrier with numerous or oversized uberctx-* entries, degrading availability of the receiving service. According to the CVSS vector, no authentication is required (PR:N), but exploitation depends on specific deployment conditions (AT:P): the separately installed Jaeger propagator must be explicitly enabled - it is not part of the default OpenTelemetry Python configuration - and the service must accept untrusted inbound propagation headers. Practical impact is modest because common Python servers cap request headers before they reach the propagator (Gunicorn defaults to 100 header fields and 8,190 bytes per field; Uvicorn/h11 buffers incomplete events at 16,384 bytes), with materially higher exposure for non-HTTP transports, custom TextMapGetter implementations, or deployments that have raised or disabled server and gateway limits. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.45.0.
Denial of service in OpenTelemetry Python (opentelemetry-api through 1.45.0) lets a single unauthenticated request carrying an oversized W3C tracestate header burn roughly 6-12 seconds of CPU, and on asyncio servers stall every other connection on the event loop for that duration. The flaw is a quadratic-time regex split in TraceState.from_header that is reached automatically through the default tracecontext propagator, so any service instrumented with something like opentelemetry-instrumentation-asgi is affected without special configuration; exploitation is gated by the fronting HTTP parser's header-size limit, with gunicorn and uvicorn's h11 parser rejecting the header while waitress and uvicorn's default httptools parser accept it. A working proof-of-concept with measured timings is included in the upstream advisory (public PoC reference), but no confirmed active exploitation (CISA KEV) is indicated in the supplied intelligence, and the assessed CVSS of 5.3 reflects availability-only impact (C:N/I:N/A:L).