What is the CVSS score of CVE-2026-50270?

CVE-2026-50270 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Which versions of Apache are affected by CVE-2026-50270?

Datadog's dd-trace-java tracing agent (versions below 1.62.0) contains a denial-of-service vulnerability that allows remote attackers to disable HTTP services using specially crafted request headers,…. A patch is available.

How to fix or mitigate CVE-2026-50270?

Within 24 hours, scan your infrastructure using asset management or APM tools to identify all dd-trace-java instances below version 1.62.0; apply temporary mitigation by setting environment variable DD_TRACE_BAGGAGE_MAX_ITEMS=0 on all instances to disable the vulnerable code path. Within 7 days, coordinate with infrastructure and development teams to prepare testing of dd-trace-java version 1.62.0+ and subscribe to Datadog security advisories to track patch release. Within 30 days, complete staged deployment of version 1.62.0+ across all environments prioritizing production, and validate remediation through load testing and monitoring.

Apache CVE-2026-50270

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-15 https://github.com/DataDog/dd-trace-java

GHSA-74xj-wh4w-vqxc

Denial Of Service Apache Nginx

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 23:17 vuln.today

Analysis Generated

Jul 15, 2026 - 23:17 vuln.today

CVE Published

Jul 15, 2026 - 22:53 github-advisory

HIGH 7.5

DescriptionGitHub Advisory

Impact

Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.

Patches

This is resolved in version 1.62.0 and later of the dd-trace-java library.

Workarounds

If users cannot upgrade immediately:

Disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently).
Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb).

Resources

Articles & Coverage 2

News 11 New Nginx Vulnerabilities - 1 Critical, 10 High Severity Jul 16, 2026 News 9 New Apache Vulnerabilities - 9 High Severity, No Public Exploits Jul 16, 2026

AnalysisAI

Remote denial of service in Datadog's dd-trace-java (dd-java-agent) tracing library affects any HTTP service instrumented with a version below 1.62.0 that has W3C baggage propagation enabled, which is the default. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on baggage injection and not on extraction, a remote unauthenticated attacker can send a single crafted 'baggage' header with a huge number of key-value pairs or one oversized value to exhaust CPU and memory. There is no public exploit identified at time of analysis and it is not on CISA KEV, but exploitation is trivially reliable (CVSS 7.5, AV:N/AC:L/PR:N).