Datadog PHP Tracer CVE-2026-50275

Requires that baggage propagation extraction be active, which the advisory states is enabled by DEFAULT in most affected deployments unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT. Exploitation is remote and pre-authentication (PR:N): the attacker only needs to reach an HTTP endpoint of an application instrumented with dd-trace-php < 1.19.2 and supply a malicious W3C baggage header; the missing DD_TRACE_BAGGAGE_MAX_ITEMS/DD_TRACE_BAGGAGE_MAX_BYTES enforcement means no special payload encoding is needed. The main limiting factor is configuration: deployments that have disabled baggage extraction in their propagation style are not exposed; impact is confined to availability (worker/host resource exhaustion), with no confidentiality or integrity effect.

This is a legitimately exploitable but availability-only issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a remote unauthenticated client sends a crafted W3C baggage header and the tracer allocates unbounded hash-map entries, exhausting CPU and memory per request. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - but the linked PR #3854, two fix commits, and the GHSA advisory disclose the exact bug and its remediation, making a working DoS trivially reconstructible from the diff. The 7.5 score reflects only availability impact (C:N/I:N), so this is a real but bounded priority: worth patching because it is remote, pre-auth, and default-enabled, yet it cannot lead to data disclosure, code execution, or lateral movement. It is a straightforward resource-exhaustion DoS, not a high-CVSS-but-illusory issue, though the ceiling of impact is a crashed/degraded PHP worker rather than compromise.

An attacker sends HTTP requests to any application instrumented with dd-trace-php < 1.19.2, each carrying a W3C baggage header packed with a huge number of comma-separated key-value pairs or one oversized value. Because ddtrace_deserialize_baggage ignores DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES, every request drives unbounded hash-map allocation and CPU consumption, and a modest flood exhausts memory/CPU and takes the PHP worker or host offline. No public weaponized exploit is listed, but the fix PR and commits fully reveal the vulnerable parser.