What is the CVSS score of CVE-2026-50273?

CVE-2026-50273 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of Datadog.Trace are affected by CVE-2026-50273?

Datadog.Trace .NET library versions before 3.43.0 contain an unauthenticated remote denial-of-service vulnerability that enables attackers to crash any internet-facing .NET application using this…. A patch is available.

How to fix or mitigate CVE-2026-50273?

Within 24 hours: Conduct immediate inventory of all internet-facing .NET services instrumented with Datadog.Trace and identify currently deployed versions; flag any running versions before 3.43.0 as exposed. Within 7 days: Implement interim mitigations by either disabling W3C baggage propagation (baggage.enabled=false) if baggage context propagation is not required for operations, or deploy WAF rules strictly limiting baggage header size to 8192 bytes maximum and enforce aggressive rate limiting on trace ingestion endpoints. Within 30 days: Continuously monitor Datadog security advisories for release of patched Datadog.Trace versions (3.43.0 or later); begin staged upgrade process starting with non-critical services once patch is available and execute complete remediation within 90 days.

Datadog.Trace CVE-2026-50273

EUVD-2026-45243 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-15 https://github.com/DataDog/dd-trace-dotnet

GHSA-38wr-vpc7-2mp4

Denial Of Service Apache Nginx

7.5

CVSS 3.1 · Vendor: https://github.com/DataDog/dd-trace-dotnet

Severity by source

Vendor (https://github.com/DataDog/dd-trace-dotnet) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated single-header trigger against default config gives AV:N/AC:L/PR:N/UI:N; impact is availability-only (resource exhaustion), so C:N/I:N/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/DataDog/dd-trace-dotnet).

CVSS VectorVendor: https://github.com/DataDog/dd-trace-dotnet

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 23:18 vuln.today

Analysis Generated

Jul 15, 2026 - 23:18 vuln.today

CVE Published

Jul 15, 2026 - 22:59 github-advisory

HIGH 7.5

DescriptionCVE.org

Impact

Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.

Patches

This is resolved in version 3.43.0 and later of the dd-trace-dotnet library.

Workarounds

If users cannot upgrade immediately:

Disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently).
Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb).

Resources

Articles & Coverage 2

News 11 New Nginx Vulnerabilities - 1 Critical, 10 High Severity Jul 16, 2026 News 9 New Apache Vulnerabilities - 9 High Severity, No Public Exploits Jul 16, 2026

AnalysisAI

Remote unauthenticated Denial of Service in the Datadog.Trace .NET tracing library (versions before 3.43.0) arises because W3C baggage HTTP headers are parsed on the extract path without enforcing the DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits that are only applied during injection. An attacker can send a single request with a baggage header containing an arbitrarily large number of comma-separated key-value pairs, forcing the tracer to allocate a hash-map entry per pair and exhausting CPU and memory. Because the baggage propagation style is enabled by default, any internet-facing service instrumented with an affected tracer is exposed; there is no public exploit identified at time of analysis and the CVSS is 7.5 (A:H only).

Technical ContextAI

The affected component is Datadog's dd-trace-dotnet APM/tracing library (NuGet packages Datadog.Trace and Datadog.Trace.OpenTracing), which implements distributed-tracing context propagation including the W3C 'baggage' specification. Baggage is transported as an HTTP header of comma-separated key=value pairs that a tracer extracts from inbound requests and stores in memory (a hash-map) for the duration of the trace. The root cause is CWE-400 (Uncontrolled Resource Consumption): the guardrails DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES were enforced only when the tracer injected baggage into outbound requests, but the extract/parse path performed no bounds checking, so untrusted inbound header content is parsed and allocated without limit. The same class of flaw was reported upstream in opentelemetry-go (GHSA-mh2q-q3fh-2475) and opentelemetry-dotnet (GHSA-g94r-2vxg-569j), indicating a systemic gap in baggage-extraction validation across tracing ecosystems rather than an isolated bug.

RemediationAI

Vendor-released patch: upgrade Datadog.Trace and Datadog.Trace.OpenTracing to version 3.43.0 or later, which enforces the item-count and byte-size limits on the baggage extract path (advisory: https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4). If immediate upgrade is not possible, disable baggage extraction by removing 'baggage' from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if it is set independently), with the trade-off that inbound baggage context will no longer be honored for distributed tracing. As a defense-in-depth compensating control, cap the maximum HTTP request header size at an upstream proxy or web server - for example Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb - noting that an overly aggressive limit can reject legitimate large-header requests and does not fully eliminate the per-pair allocation cost below the cap. Prioritize internet-facing instrumented services first.