CVE-2026-50274

Received Received - Intake

Denial of Service in Datadog dd-trace-go via W3C Baggage Header

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-50274

Affected Vendors & Products

Vendor	Product	Version / Range
datadog	dd-trace-go	to 2.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects Datadog's dd-trace-go library before version 2.8.1. It involves improper handling of W3C baggage headers in HTTP requests. Attackers can send requests with excessively large baggage headers containing many key-value pairs or oversized values, causing unbounded CPU and memory consumption. This leads to a denial of service condition for services using baggage propagation.

Detection Guidance

To detect this vulnerability, check if your Datadog dd-trace-go library version is below 2.8.1. Run: go list -m github.com/DataDog/dd-trace-go@version. If the version is older, the system is vulnerable.

Impact Analysis

If you use a vulnerable version of dd-trace-go with baggage propagation enabled, an attacker could send specially crafted HTTP requests to your service. This would consume excessive server resources, potentially causing your application to slow down or crash, disrupting normal operations and availability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial of service attacks that disrupt services handling sensitive data. Unbounded CPU and memory consumption may lead to service unavailability, which could violate availability requirements under GDPR Article 32 and HIPAA Security Rule requirements for access control and integrity.

Mitigation Strategies

Upgrade the Datadog dd-trace-go library to version 2.8.1 or later. Update your Go module dependencies using: go get -u github.com/DataDog/dd-trace-go@latest. Restart affected services after updating.

Hi! I’m here to help you understand CVE-2026-50274. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70