OpenTelemetry Python flaw lets one message stall an agent server

A denial-of-service flaw in the OpenTelemetry Python API can be triggered by a single malformed trace header, according to a GitHub security advisory published on 13 November 2026. The issue, tracked as CVE-2026-126360 and GHSA-mf5v-w3w3-f6cg, affects the opentelemetry-api package on PyPI and is fixed in version 1.45.2.

The problem sits in TraceContextTextMapPropagator.extract(), the function that reads W3C trace context — the standard identifiers that let a request be followed across services — out of an incoming message. The advisory says the function is vulnerable to regular expression denial of service, or ReDoS, where a crafted string forces a regex engine into far more work than the input length suggests.

The trigger is specific. According to the advisory, a malformed value containing a trace-context prefix followed by a long run of whitespace and an embedded newline causes quadratic-time regex backtracking. Applications that pull trace context from untrusted carriers that accept such strings can see excessive CPU use and delays in processing requests.

The practical sting is in where that parsing runs. The advisory notes that when extraction happens on an asynchronous server's event-loop thread, one malicious message can delay unrelated requests handled by the same event loop. Repeated messages may sustain the degradation.

Ordinary HTTP traffic is not the main worry here. The advisory points out that conforming HTTP header values cannot contain embedded newlines, so the usual path for a traceparent header is not exploitable. But OpenTelemetry carriers are not limited to HTTP headers. JSON strings can contain escaped newlines that become real newline characters once decoded.

That is what makes this relevant to agent infrastructure. The advisory names MCP request metadata as one relevant integration path: applications may extract trace context from the JSON params._meta field of a Model Context Protocol message. MCP is the protocol many AI agents use to talk to tools and data servers. The advisory says HTTP header validation does not constrain a traceparent string carried inside a JSON body, so the usual guard rails do not apply.

Exposure is conditional rather than universal. According to the advisory, it depends on the MCP SDK or instrumentation version in use, whether extraction actually invokes the W3C Trace Context propagator, and what message-size limits are in force. Whether an attacker needs to authenticate depends on the application exposing the carrier.

The advisory is clear about the limits of the finding. The demonstrated impact is denial of service through CPU exhaustion and blocked request processing. It does not demonstrate data disclosure, data modification or code execution.

The fix changes the parsing logic in two ways. Version 1.45.2 rejects traceparent values longer than 512 characters before any regex matching takes place, and removes the overlapping suffix and trailing-whitespace expressions that allowed the backtracking.

For teams that cannot upgrade immediately, the advisory recommends rejecting oversized values and stripping or refusing embedded carriage return and line feed characters before passing untrusted trace-context values to the propagator.

The case is a reminder that observability plumbing is part of an agent's attack surface. Telemetry fields travel with agent traffic, are frequently attacker-influenced, and are often parsed before any application-level authorisation check runs.