The vulnerability arises from the parsing of W3C tracestate headers in the OpenTelemetry Python API. A regular expression that accepts optional whitespace operates without bounds, allowing a header that contains a long sequence of spaces or tabs before a comma to trigger quadratic back‑tracking. This exploits the parser in the TraceContextTextMapPropagator.extract function, causing it to consume excessive CPU resources for a single unauthenticated request. The flaw does not expose or alter telemetry data and does not lead to code execution; its effect is limited to degrading service availability.

All installations of OpenTelemetry Python that are older than version 1.45.1 are affected. Software built on the open-telemetry:opentelemetry-python package and that use the default W3C Trace Context propagator remains vulnerable. The issue was addressed in release v1.45.1. No other versions are known to be impacted beyond this cutoff.

The CVSS score of 5.3 indicates moderate severity, and the lack of an EPSS score means current exploit probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. An attacker can perform the exploit by sending a single HTTP request with a malicious tracestate header containing an unbounded run of whitespace, which is unauthenticated and can originate from any network or local source. The attack depends on the target accepting large headers, and its impact is to over‑consume CPU time on a worker or event loop, potentially delaying or blocking other requests. Given the lack of code execution or data disclosure, the primary risk is denial of service.