CVE-2026-50274

Name of the Vulnerable Software and Affected Versions dd-trace-go versions prior to 2.8.1

Description Datadog tracing libraries implementing W3C baggage propagation fail to enforce limits on the number of items or total bytes when parsing incoming baggage HTTP headers during the extraction process. While limits are defined by DD TRACE BAGGAGE MAX ITEMS and DD TRACE BAGGAGE MAX BYTES, they were only applied to baggage injection. A remote, unauthenticated attacker can exploit this by sending a request with a baggage header containing an excessively large number of comma-separated key-value pairs or a single oversized value. This forces the tracer to allocate a hash-map entry for each pair, leading to unbounded CPU and memory consumption, which results in a denial of service for HTTP services with baggage propagation enabled. This propagation style is enabled by default in most affected tracers.

Recommendations Update dd-trace-go to version 2.8.1 or later. Disable baggage extraction by removing baggage from the DD TRACE PROPAGATION STYLE or DD TRACE PROPAGATION STYLE EXTRACT variables. Cap the maximum HTTP request header size at an upstream proxy or web server.