CVE-2026-54788

Name of the Vulnerable Software and Affected Versions dd-trace-rs versions 0.1.0 through 0.3.2

Description The software fails to enforce a pair count or entry size limit when parsing the W3C tracestate header in datadog-opentelemetry/src/propagation/tracecontext.rs. Specifically, the parser collects every semicolon-separated key and value pair within the dd=... vendor entry into a HashMap. Since tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry, leading to excessive CPU and memory consumption and resulting in a denial of service for instrumented network services.

Recommendations Update to version 0.3.3 or later. Disable tracecontext extraction by setting DD TRACE PROPAGATION STYLE EXTRACT to a value that does not include tracecontext (e.g., datadog). Cap the maximum HTTP request header size at an upstream proxy or web server.