{"action":"Upgrade opentelemetry-api to 1.45.1 or later.","affected":[{"fixed":"1.45.1","introduced":"0"}],"component":"opentelemetry-api","cve_ids":["CVE-2026-114603"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.45.1"],"ghsa_id":"GHSA-xcq7-p3pf-p88h","id":"tcs_01M5JMCWXNGGJ8D0NEKM5E8E2P","modified_at":"2026-10-22T16:30:40.999595074Z","published_at":"2026-10-22T16:22:07Z","references":["https://osv.dev/vulnerability/GHSA-xcq7-p3pf-p88h","https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h","https://github.com/open-telemetry/opentelemetry-python/pull/5749","https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b","https://github.com/open-telemetry/opentelemetry-python","https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06","https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-xcq7-p3pf-p88h","url":"https://osv.dev/vulnerability/GHSA-xcq7-p3pf-p88h"}],"summary":"OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api"}