CVE-2026-126360

## Summary `TraceContextTextMapPropagator.extract()` in `opentelemetry-api` is vulnerable to regular expression denial of service (ReDoS) when processing a specially crafted `traceparent` value. A malformed value containing a trace-context prefix followed by a long whitespace sequence and an embedded newline triggers quadratic-time regex backtracking. Applications that extract trace context from untrusted carriers accepting such strings can experience excessive CPU consumption and request-processing delays. When extraction runs on an asynchronous server’s event-loop thread, a single malicious message can delay unrelated requests handled by that event loop. ## Exposure conditions Exploitation requires attacker-controlled input to reach the affected propagator through a carrier that preserves embedded newlines and permits a sufficiently large value. Conforming HTTP header values cannot contain embedded newlines. However, OpenTelemetry carriers are not restricted to HTTP headers. JSON strings can contain escaped newlines that become newline characters after decoding. MCP request metadata is one relevant integration path: applications may extract trace context from JSON `params._meta`. Exposure depends on the MCP SDK or instrumentation version, whether extraction invokes the W3C Trace Context propagator, and applicable message-size limits. HTTP header validation does not constrain a `traceparent` string carried inside a JSON body. Authentication requirements depend on the application exposing the carrier. ## Impact The demonstrated impact is denial of service through excessive CPU consumption and blocked request processing. Repeated malicious messages may sustain service degradation. This finding does not demonstrate data disclosure, data modification, or code execution. ## Remediation Upgrade `opentelemetry-api` to `1.45.2` or a later release containing the fix. Version `1.45.2` rejects `traceparent` values longer than 512 characters before regex matching