dd-trace-py CVE-2026-50271
HIGH
GHSA-mw54-j2v2-42hr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A single unauthenticated network request against a default-enabled feature triggers unbounded allocation, so AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H, C:N/I:N).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.
Patches
This is resolved in version 4.8.2 and later of the dd-trace-py library
Workarounds
If users cannot upgrade immediately:
- Disable
baggageextraction by removingbaggagefromDD_TRACE_PROPAGATION_STYLE(orDD_TRACE_PROPAGATION_STYLE_EXTRACTif set independently). - Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache
LimitRequestFieldSize, Nginxlarge_client_header_buffers, Envoymax_request_headers_kb).
Resources
Related upstream advisories: opentelemetry-go GHSA-mh2q-q3fh-2475 opentelemetry-dotnet GHSA-g94r-2vxg-569j
Articles & Coverage 2
AnalysisAI
Remote denial of service in Datadog's dd-trace-py Python tracing library (versions before 4.8.2) lets unauthenticated attackers exhaust CPU and memory by sending oversized W3C 'baggage' HTTP headers. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safeguards were enforced only on baggage injection, never on extraction, so a single crafted request with a huge number of comma-separated pairs forces the tracer to allocate a hash-map entry per pair on every request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target service must run dd-trace-py < 4.8.2 AND have the W3C 'baggage' propagation style enabled on the extract path - which is the default in most affected tracers, so no non-default configuration is required to be vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5, HIGH) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, availability-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker finds a reachable Python web service instrumented with a vulnerable dd-trace-py version and default baggage propagation, then sends HTTP requests carrying a 'baggage' header packed with hundreds of thousands of comma-separated key-value pairs (or one enormous value). Each request forces the tracer to build a hash-map entry per pair, spiking CPU and memory until a modest flood exhausts server resources and knocks the service offline. … |
| Remediation | Vendor-released patch: upgrade dd-trace-py ('ddtrace') to version 4.8.2 or later, per Datadog advisory GHSA-mw54-j2v2-42hr (https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all services running dd-trace-py versions prior to 4.8.2, particularly internet-facing or untrusted-network-exposed applications, and escalate affected services to an elevated monitoring status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today