Vulnerability GHSA-mf5v-w3w3-f6cg

Summary

TraceContextTextMapPropagator.extract() in opentelemetry-api is vulnerable to regular expression denial of service (ReDoS) when processing a specially crafted traceparent value.

A malformed value containing a trace-context prefix followed by a long whitespace sequence and an embedded newline triggers quadratic-time regex backtracking. Applications that extract trace context from untrusted carriers accepting such strings can experience excessive CPU consumption and request-processing delays.

When extraction runs on an asynchronous server’s event-loop thread, a single malicious message can delay unrelated requests handled by that event loop.

Exposure conditions

Exploitation requires attacker-controlled input to reach the affected propagator through a carrier that preserves embedded newlines and permits a sufficiently large value.

Conforming HTTP header values cannot contain embedded newlines. However, OpenTelemetry carriers are not restricted to HTTP headers. JSON strings can contain escaped newlines that become newline characters after decoding.

MCP request metadata is one relevant integration path: applications may extract trace context from JSON params._meta. Exposure depends on the MCP SDK or instrumentation version, whether extraction invokes the W3C Trace Context propagator, and applicable message-size limits. HTTP header validation does not constrain a traceparent string carried inside a JSON body.

Authentication requirements depend on the application exposing the carrier.

Impact

The demonstrated impact is denial of service through excessive CPU consumption and blocked request processing. Repeated malicious messages may sustain service degradation.

This finding does not demonstrate data disclosure, data modification, or code execution.

Remediation

Upgrade opentelemetry-api to 1.45.2 or a later release containing the fix.

Version 1.45.2 rejects traceparent values longer than 512 characters before regex matching and removes the overlapping suffix and trailing-whitespace expressions.

Where upgrading is temporarily unavailable, reject oversized values and embedded CR/LF characters before passing untrusted trace-context values to the affected propagator.