opentelemetry_api-1.40.0-py3-none-any.whl: 1 vulnerabilities (highest severity is: 5.3)

Open Beginner friendly
  • Is something wrong?
#517 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
devops, security

Research direction

Start with docker-compose/agent-eval-canary/pyproject.toml and check the dependency version, then inspect the dependency declaration for examples/agent-evals/genai-sdk if needed. Upgrade opentelemetry-api to 1.45.1 or later and check that both affected environments resolve the fixed version; the issue does not name specific tests to run.

Written by the indexing model from the issue text.

Description

Mend: dependency security vulnerability untriaged
Vulnerable Library - opentelemetry_api-1.40.0-py3-none-any.whl

OpenTelemetry Python API

Library home page: https://files.pythonhosted.org/packages/5f/bf/93795954016c522008da367da292adceed71cca6ee1717e1d64c83089099/opentelemetry_api-1.40.0-py3-none-any.whl

Sample Path to Dependency File: /docker-compose/agent-eval-canary/pyproject.toml

Path to vulnerable library: /docker-compose/agent-eval-canary/.venv/lib/python3.10/site-packages/opentelemetry_api-1.40.0.dist-info,/examples/agent-evals/genai-sdk/.venv/lib/python3.10/site-packages/opentelemetry_api-1.40.0.dist-info

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (opentelemetry_api version) Remediation Possible**
CVE-2026-114603 Medium 5.3 opentelemetry_api-1.40.0-py3-none-any.whl Direct 1.45.1 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-114603
Vulnerable Library - opentelemetry_api-1.40.0-py3-none-any.whl

OpenTelemetry Python API

Library home page: https://files.pythonhosted.org/packages/5f/bf/93795954016c522008da367da292adceed71cca6ee1717e1d64c83089099/opentelemetry_api-1.40.0-py3-none-any.whl

Sample Path to Dependency File: /docker-compose/agent-eval-canary/pyproject.toml

Path to vulnerable library: /docker-compose/agent-eval-canary/.venv/lib/python3.10/site-packages/opentelemetry_api-1.40.0.dist-info,/examples/agent-evals/genai-sdk/.venv/lib/python3.10/site-packages/opentelemetry_api-1.40.0.dist-info

Dependency Hierarchy:

  • ❌ opentelemetry_api-1.40.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.

Publish Date: 2026-10-22

URL: CVE-2026-114603

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-22

Fix Resolution: 1.45.1

⛑️ Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

Dominant language
JavaScript
Stars
44
Forks
41
Avg merge
1d 9h
Merged PRs (30d)
17

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from opensearch-project/observability-stack

All issues in opensearch-project/observability-stack

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.