Is CVE-2026-126360 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126360 being exploited in the wild.

How severe is CVE-2026-126360?

Medium severity, with a CVSS score of 5.3, published 13 November 2026.

Which products and versions are affected?

Opentelemetry-Api prior to 1.45.2.

Is there a fix for CVE-2026-126360?

Yes: fixed in 1.45.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126360 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126360?

Check whether you run Opentelemetry-Api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126360: OpenTelemetry Python ReDoS in traceparent parsing

CVE-2026-126360 · Severity: medium · CVSS 5.3 · Published 2026-11-13

OpenTelemetry Python is an observability SDK used to collect performance and debugging data from applications. A flaw in the traceparent header parser allows an attacker to send a specially crafted request that causes excessive CPU consumption on the server, potentially delaying legitimate requests. This can lead to application slowdowns or denial of service, though only if the carrier format allows embedded newlines (such as JSON-based carriers) rather than standard HTTP headers.

Technologies: Opentelemetry-Api. Vendors: Opentelemetry.

Quick answers

Is CVE-2026-126360 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126360 being exploited in the wild.
How severe is CVE-2026-126360?: Medium severity, with a CVSS score of 5.3, published 13 November 2026.
Which products and versions are affected?: Opentelemetry-Api prior to 1.45.2.
Is there a fix for CVE-2026-126360?: Yes: fixed in 1.45.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126360 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126360?: Check whether you run Opentelemetry-Api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.45.2

Technical details

A regular expression in TraceContextTextMapPropagator.extract() is vulnerable to quadratic-time backtracking when processing a malformed traceparent value containing a trace-context prefix, long whitespace sequence, and embedded newline. The vulnerability requires an attacker-controlled carrier that preserves newlines and permits sufficiently large values, since conforming HTTP headers cannot contain embedded newlines. JSON-based carriers and applicable MCP request metadata integrations can preserve the required newline depending on SDK, instrumentation, and message-size limits, causing CPU exhaustion on the event-loop thread.

Affected products

OpenTelemetry opentelemetry-api prior to 1.45.2

Timeline

2026-11-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.