CVE-2026-54788

Received Received - Intake

Denial of Service in dd-trace-rs via W3C tracestate Parsing

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-54788

EUVD

EUVD-2026-67829

Affected Vendors & Products

Vendor	Product	Version / Range
datadog	dd-trace-rs	From 0.1.0 (inc) to 0.3.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects the DataDog tracing library dd-trace-rs for Rust, versions 0.1.0 to 0.3.2. It involves unbounded parsing of the W3C tracestate header, specifically the Datadog vendor entry (dd=...). The parser creates a hash-map entry for each semicolon-separated key-value pair without size limits, allowing remote attackers to send large headers causing excessive CPU and memory usage per request, leading to Denial of Service (DoS).

Detection Guidance

Check if your system uses dd-trace-rs versions 0.1.0 to 0.3.2. Monitor for unusually high CPU or memory usage during request processing. Inspect HTTP headers for maliciously large tracestate headers containing excessive semicolon-separated key-value pairs.

Impact Analysis

If you use an affected version of dd-trace-rs, an unauthenticated remote attacker could send specially crafted tracestate headers to your instrumented network service. This would consume excessive system resources (CPU and memory) for each request, potentially causing service slowdowns or crashes. Internet-facing services are particularly at risk unless mitigations are applied.

Mitigation Strategies

Upgrade dd-trace-rs to version 0.3.3 or later. Disable tracecontext extraction if not required. Configure upstream proxies to cap HTTP request header sizes. Limit tracestate header parsing to first 32 entries if custom configuration is possible.

Hi! I’m here to help you understand CVE-2026-54788. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70