opentelemetry_exporter_otlp_proto_grpc-1.44.0-py3-none-any.whl: 1 vulnerabilities (highest severity is: 5.3)

Open Beginner friendly
  • Is something wrong?
#522 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
70/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
devops, security

Research direction

Start with examples/strands/code-assistant/pyproject.toml and inspect how its OpenTelemetry exporter dependency is declared and locked. Check whether the OpenTelemetry API can be upgraded to 1.45.1, the version listed as fixing CVE-2026-114603. Done means the example's dependency resolves without the vulnerable version.

Written by the indexing model from the issue text.

Description

Mend: dependency security vulnerability untriaged
Vulnerable Library - opentelemetry_exporter_otlp_proto_grpc-1.44.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/opentelemetry_api-1.44.0.dist-info

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (opentelemetry_exporter_otlp_proto_grpc version) Remediation Possible**
CVE-2026-114603 Medium 5.3 opentelemetry_api-1.44.0-py3-none-any.whl Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-114603
Vulnerable Library - opentelemetry_api-1.44.0-py3-none-any.whl

OpenTelemetry Python API

Library home page: https://files.pythonhosted.org/packages/ca/6f/a04e900f465ff3221ccc395522503e2d10e79fa21f2723c8e177aae1e0d1/opentelemetry_api-1.44.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/opentelemetry_api-1.44.0.dist-info

Dependency Hierarchy:

  • opentelemetry_exporter_otlp_proto_grpc-1.44.0-py3-none-any.whl (Root Library)
    • ❌ opentelemetry_api-1.44.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.

Publish Date: 2026-10-22

URL: CVE-2026-114603

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-22

Fix Resolution: opentelemetry-api - 1.45.1

Dominant language
JavaScript
Stars
44
Forks
41
Avg merge
1d 9h
Merged PRs (30d)
17

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from opensearch-project/observability-stack

All issues in opensearch-project/observability-stack

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.