opentelemetry-python vulnerabilities
CVEs whose affected-version data names the opentelemetry-python package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-116694Medium· 6.3OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byt…
▾ Sunlitopen-telemetry · opentelemetry-pythonEPSS 0.38%via CVEORG
CVE-2026-114603Medium· 5.3PoCOpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses …
▾ Twilightopen-telemetry · opentelemetry-pythonEPSS 0.49%via CVEORG