CVE-2026-50270
Received Received - Intake

Denial of Service in dd-trace-java via Unbounded Baggage Header

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-50270
EUVD
EUVD-2026-77670

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
datadog dd-trace-java 1.62.0
datadog dd-trace-java to 1.62.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the dd-trace-java library, a Datadog APM client for Java. Before version 1.62.0, the library did not enforce size limits during extraction of W3C baggage headers from HTTP requests. Attackers could send requests with excessive baggage data, causing the library to consume unbounded CPU and memory resources, leading to denial of service.

Detection Guidance

Check if your dd-trace-java version is below 1.62.0 using commands like 'java -jar your-app.jar -version' or inspecting dependency files. Monitor for high CPU or memory usage in services using dd-trace-java, particularly those handling HTTP requests with baggage headers. Look for excessive parsing time in logs or performance metrics.

Impact Analysis

An unauthenticated remote attacker could exploit this to overload your HTTP service by sending specially crafted baggage headers. This may cause your application to slow down or crash, disrupting service availability for legitimate users.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires maintaining service availability for data subjects, while HIPAA mandates ensuring access to protected health information systems. Unbounded resource consumption from this issue could lead to prolonged downtime, violating availability requirements in both standards.

Mitigation Strategies

Upgrade dd-trace-java to version 1.62.0 or later immediately. If upgrading is not possible, disable baggage extraction by setting 'DD_TRACE_BAGGAGE_PROPAGATION_STYLE=none' or limit HTTP header sizes at upstream proxies or web servers to prevent oversized baggage headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart