What is the CVSS score of CVE-2026-50271?

CVE-2026-50271 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of dd-trace-py are affected by CVE-2026-50271?

A remote denial-of-service vulnerability in Datadog's dd-trace-py library (pre-4.8.2) allows unauthenticated attackers to crash Python services through resource exhaustion via malformed HTTP headers.. A patch is available.

How to fix or mitigate CVE-2026-50271?

Within 24 hours, inventory all services running dd-trace-py versions prior to 4.8.2, particularly internet-facing or untrusted-network-exposed applications, and escalate affected services to an elevated monitoring status. Within 7 days, deploy interim mitigations: disable baggage header propagation by setting DD_TRACE_BAGGAGE_ENABLED=false if not operationally critical to tracing workflows, enforce HTTP header size limits (≤8192 bytes) at the load balancer or WAF layer, and enable request rate-limiting to absorb DoS traffic spikes. Within 30 days, monitor Datadog's security advisories for a confirmed patch release to dd-trace-py 4.8.2 or later, test the patch in staging environments, and plan a coordinated upgrade rollout across all affected production services with change control approval.

dd-trace-py CVE-2026-50271

EUVD-2026-45329 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-15 https://github.com/DataDog/dd-trace-py

GHSA-mw54-j2v2-42hr

Nginx Apache Denial Of Service

7.5

CVSS 3.1 · Vendor: https://github.com/DataDog/dd-trace-py

Severity by source

Vendor (https://github.com/DataDog/dd-trace-py) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

A single unauthenticated network request against a default-enabled feature triggers unbounded allocation, so AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/DataDog/dd-trace-py).

CVSS VectorVendor: https://github.com/DataDog/dd-trace-py

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 23:17 vuln.today

Analysis Generated

Jul 15, 2026 - 23:17 vuln.today

CVE Published

Jul 15, 2026 - 22:55 github-advisory

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on ddtrace (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.8.2.

DescriptionCVE.org

Impact

Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.

Patches

This is resolved in version 4.8.2 and later of the dd-trace-py library

Workarounds

If users cannot upgrade immediately:

Disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently).
Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb).

Resources

Articles & Coverage 2

News 11 New Nginx Vulnerabilities - 1 Critical, 10 High Severity Jul 16, 2026 News 9 New Apache Vulnerabilities - 9 High Severity, No Public Exploits Jul 16, 2026

AnalysisAI

Remote denial of service in Datadog's dd-trace-py Python tracing library (versions before 4.8.2) lets unauthenticated attackers exhaust CPU and memory by sending oversized W3C 'baggage' HTTP headers. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safeguards were enforced only on baggage injection, never on extraction, so a single crafted request with a huge number of comma-separated pairs forces the tracer to allocate a hash-map entry per pair on every request. Because the baggage propagation style is enabled by default, any reachable service instrumented with an affected tracer is exposed; no public exploit identified at time of analysis.

Technical ContextAI

The weakness sits in dd-trace-py's implementation of W3C Trace Context 'baggage' propagation, a standard that carries arbitrary application key-value context in the HTTP 'baggage' header across distributed services. On the extract (inbound) path the parser splits the header into comma-separated key-value pairs and materializes each into a hash-map entry without first validating the count against DD_TRACE_BAGGAGE_MAX_ITEMS or total size against DD_TRACE_BAGGAGE_MAX_BYTES - those limits were wired only into the inject (outbound) path. This is a textbook CWE-400 Uncontrolled Resource Consumption, where attacker-controlled untrusted input drives unbounded allocation. The affected component is the PyPI distribution 'ddtrace' (CPE pkg:pip/ddtrace). Datadog notes the same design flaw class affects sibling baggage implementations, citing advisories for opentelemetry-go (GHSA-mh2q-q3fh-2475) and opentelemetry-dotnet (GHSA-g94r-2vxg-569j).

RemediationAI

Vendor-released patch: upgrade dd-trace-py ('ddtrace') to version 4.8.2 or later, per Datadog advisory GHSA-mw54-j2v2-42hr (https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr). If you cannot upgrade immediately, disable baggage extraction by removing 'baggage' from DD_TRACE_PROPAGATION_STYLE (or from DD_TRACE_PROPAGATION_STYLE_EXTRACT if it is set independently); the trade-off is loss of baggage-based context propagation across traced services, while core tracing continues to function. As a complementary perimeter control, cap the maximum HTTP request header size at an upstream proxy or web server - for example Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb - which limits the attack payload but must be tuned so legitimate large headers (cookies, auth tokens) are not rejected.