CVE-2026-50273

Name of the Vulnerable Software and Affected Versions Datadog .NET Tracer versions prior to 3.43.0

Description Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing limits on the number of items or the total byte size during extraction. While limits are defined by DD TRACE BAGGAGE MAX ITEMS and DD TRACE BAGGAGE MAX BYTES, they were only applied to baggage injection. A remote unauthenticated attacker can send a request containing a baggage header with an excessively large number of comma-separated key-value pairs or a single very large value. This causes the tracer to allocate a hash-map entry for each pair, leading to unbounded CPU and memory consumption, which enables a remote Denial of Service (DoS) against HTTP services with baggage propagation enabled. This propagation style is enabled by default in most affected tracers.

Recommendations Update Datadog .NET Tracer to version 3.43.0 or later. Disable baggage extraction by removing baggage from the DD TRACE PROPAGATION STYLE variable or the DD TRACE PROPAGATION STYLE EXTRACT variable. Cap the maximum HTTP request header size at an upstream proxy or web server.