CVE-2026-50272

Name of the Vulnerable Software and Affected Versions dd-trace versions prior to 5.100.0

Description An issue exists in the W3C baggage propagation within packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text map.js where incoming baggage HTTP headers are parsed without enforcing limits on the number of items or total bytes during extraction. While DD TRACE BAGGAGE MAX ITEMS and DD TRACE BAGGAGE MAX BYTES were applied to baggage injection, they were not enforced during extraction. A remote, unauthenticated attacker can send a request containing a baggage header with an excessively large number of comma-separated key-value pairs or a single very large value. This causes the tracer to allocate a hash-map entry for each pair, leading to unbounded CPU and memory consumption, which enables a remote denial of service against HTTP services with baggage propagation enabled. This propagation style is enabled by default in most affected tracers.

Recommendations Update dd-trace to version 5.100.0 or later. Disable baggage extraction by removing baggage from DD TRACE PROPAGATION STYLE or DD TRACE PROPAGATION STYLE EXTRACT. Cap the maximum HTTP request header size at an upstream proxy or web server.