dd-trace-go CVE-2026-50274
HIGH
GHSA-74j5-xf3v-crq8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated single-request attack, no user interaction, against default-on baggage parsing (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS (A:H, C:N/I:N).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.
Patches
This is resolved in version 2.8.1 and later of the dd-trace-go library.
Workarounds
If users cannot upgrade immediately:
- Disable
baggageextraction by removingbaggagefromDD_TRACE_PROPAGATION_STYLE(orDD_TRACE_PROPAGATION_STYLE_EXTRACTif set independently). - Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache
LimitRequestFieldSize, Nginxlarge_client_header_buffers, Envoymax_request_headers_kb).
Resources
Related upstream advisories: opentelemetry-go GHSA-mh2q-q3fh-2475 opentelemetry-dotnet GHSA-g94r-2vxg-569j
Articles & Coverage 2
AnalysisAI
Remote denial of service in Datadog's dd-trace-go APM library lets unauthenticated attackers exhaust CPU and memory on any instrumented HTTP service by sending an oversized W3C 'baggage' header. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safety limits were enforced only on baggage injection, not extraction, so a single crafted request with a huge number of comma-separated key-value pairs forces one hash-map allocation per pair on every request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target service is instrumented with an affected dd-trace-go version AND has the 'baggage' propagation style enabled on the extract path - which is the default in most affected tracers, so no non-default configuration is needed in typical deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) is internally consistent with the description: remote, low-complexity, unauthenticated, no user interaction, availability-only impact - a textbook DoS with no confidentiality or integrity loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker finds an internet-facing Go web service instrumented with an affected dd-trace-go version (baggage propagation on by default) and sends HTTP requests carrying a 'baggage' header packed with tens of thousands of comma-separated key=value pairs, or one enormous value. Each request forces the tracer to allocate a hash-map entry per pair, spiking CPU and memory; repeating or parallelizing the requests drives the process to resource exhaustion and takes the service offline. … |
| Remediation | Vendor-released patch: upgrade dd-trace-go to version 2.8.1 or later, which enforces the item-count and byte-size limits on the extract path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of Go services using dd-trace-go by scanning dependencies and build artifacts, then implement one or more mitigations: deploy WAF or API gateway rules to reject HTTP requests with baggage headers exceeding 8192 bytes, or disable trace baggage propagation entirely by setting the environment variable DD_TRACE_BAGGAGE_MAX_ITEMS=0 if the feature is not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today