What is the CVSS score of CVE-2026-50274?

CVE-2026-50274 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of dd-trace-go are affected by CVE-2026-50274?

Datadog's dd-trace-go library used in Go services faces a denial-of-service vulnerability (CVE-2026-50274) that could crash or severely degrade production systems via unauthenticated requests; no…. A patch is available.

How to fix or mitigate CVE-2026-50274?

Within 24 hours, conduct a complete inventory of Go services using dd-trace-go by scanning dependencies and build artifacts, then implement one or more mitigations: deploy WAF or API gateway rules to reject HTTP requests with baggage headers exceeding 8192 bytes, or disable trace baggage propagation entirely by setting the environment variable DD_TRACE_BAGGAGE_MAX_ITEMS=0 if the feature is not operationally required. Within 7 days, validate that mitigations are active and logged across all production services, and establish alerting for abnormal baggage header sizes to detect exploitation attempts. Within 30 days, monitor Datadog's official security advisories for a released patch, then schedule and execute a library upgrade to the patched version immediately upon availability, testing in staging environments first.

dd-trace-go CVE-2026-50274

EUVD-2026-45328 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-15 https://github.com/DataDog/dd-trace-go

GHSA-74j5-xf3v-crq8

Nginx Apache Denial Of Service Red Hat Suse

7.5

CVSS 3.1 · Vendor: https://github.com/DataDog/dd-trace-go

Severity by source

Vendor (https://github.com/DataDog/dd-trace-go) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated single-request attack, no user interaction, against default-on baggage parsing (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/DataDog/dd-trace-go).

CVSS VectorVendor: https://github.com/DataDog/dd-trace-go

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 23:31 vuln.today

Analysis Generated

Jul 15, 2026 - 23:31 vuln.today

CVE Published

Jul 15, 2026 - 23:05 github-advisory

HIGH 7.5

DescriptionCVE.org

Impact

Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.

Patches

This is resolved in version 2.8.1 and later of the dd-trace-go library.

Workarounds

If users cannot upgrade immediately:

Disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently).
Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb).

Resources

Articles & Coverage 2

News 11 New Nginx Vulnerabilities - 1 Critical, 10 High Severity Jul 16, 2026 News 9 New Apache Vulnerabilities - 9 High Severity, No Public Exploits Jul 16, 2026

AnalysisAI

Remote denial of service in Datadog's dd-trace-go APM library lets unauthenticated attackers exhaust CPU and memory on any instrumented HTTP service by sending an oversized W3C 'baggage' header. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safety limits were enforced only on baggage injection, not extraction, so a single crafted request with a huge number of comma-separated key-value pairs forces one hash-map allocation per pair on every request. Because baggage propagation is enabled by default, any internet-facing Go service using an affected tracer is exposed; there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw lives in the W3C Trace Context 'baggage' propagation implementation of Datadog's Go tracing library (CPEs pkg:go/github.com_datadog_dd-trace-go and its v2 module). Baggage is a standardized HTTP header carrying arbitrary comma-separated key=value pairs that tracers extract on inbound requests and re-inject on outbound calls to propagate context across services. The extract-path parser iterates the header and allocates a hash-map entry for each pair without applying the configured item-count or byte-size caps, which is the classic CWE-400 (Uncontrolled Resource Consumption) root cause: attacker-controlled input drives unbounded allocation. The same design defect affects other tracers in the OpenTelemetry ecosystem, as reflected in the related opentelemetry-go (GHSA-mh2q-q3fh-2475) and opentelemetry-dotnet (GHSA-g94r-2vxg-569j) advisories.

RemediationAI

Vendor-released patch: upgrade dd-trace-go to version 2.8.1 or later, which enforces the item-count and byte-size limits on the extract path. Note the advisory does not list a fixed release for the legacy v1 branch (vulnerable <= 1.24.1, fixed in None), so v1 users should migrate to the patched v2 module rather than expect a v1 backport. If immediate upgrade is not possible, disable baggage extraction by removing 'baggage' from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently) - this stops the parsing entirely but loses cross-service baggage context. As a complementary control, cap maximum HTTP request header size at an upstream proxy or web server (Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb); the trade-off is that an overly tight limit can reject legitimate large headers such as big cookies or auth tokens, so tune it to your traffic. Details are in the vendor advisory at https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8.