Denial of service through the trace context header (OpenTelemetry)
An unauthenticated request with a crafted tracestate header could stall the API and document processing for several seconds per request. Fixed in release 2026.10.24-1 (cloud) and image 2026.10.26-1 (self-hosted).
- Published
- Severity
- High
- CVE
- CVE-2026-114603
| Product | Affected | Fixed in | What to do |
|---|---|---|---|
| DocAI Fabric cloud (US and Australia) | Releases before 2026.10.24-1 | 2026.10.24-1, deployed 2026-10-24 | Nothing. The fix is deployed. |
| Self-hosted image | Images before 2026.10.26-1, only when Azure Monitor telemetry is enabled (APPLICATIONINSIGHTS_CONNECTION_STRING is set) | 2026.10.26-1, published 2026-10-26 | Update the image to 2026.10.26-1 or later. A deployment without APPLICATIONINSIGHTS_CONNECTION_STRING is not affected. |
Description
When Azure Monitor telemetry is enabled, DocAI Fabric reads the W3C trace context
of every incoming request with the OpenTelemetry library, before the request is
authenticated. In opentelemetry-api before 1.45.1, parsing the tracestate
header takes time quadratic in its length: one request with a header of about
100 KB keeps a CPU busy for several seconds. During that time the replica that
received it answers no other request and its document processing pauses.
No account is needed to send such a request.
Fix
Releases 2026.10.24-1 (cloud) and 2026.10.26-1 (self-hosted image) update the OpenTelemetry libraries to 1.45.1.
Workarounds
Until you can update a self-hosted deployment, either unset
APPLICATIONINSIGHTS_CONNECTION_STRING, which turns telemetry export off, or
have the reverse proxy in front of DocAI Fabric reject requests whose headers
exceed a few kilobytes.
References
- GitHub advisory GHSA-xcq7-p3pf-p88h: https://github.com/advisories/GHSA-xcq7-p3pf-p88h