What is the CVSS score of CVE-2026-50277?

CVE-2026-50277 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate CVE-2026-50277?

Within 24 hours, inventory every service and container image that embeds dd-trace-cpp at a version below 2.1.0, prioritizing internet-facing workloads, and apply the interim configuration control by removing baggage from DD_TRACE_PROPAGATION_STYLE and DD_TRACE_PROPAGATION_STYLE_EXTRACT (or otherwise disabling baggage extraction) while also enforcing a maximum inbound 'baggage' header size at the load balancer, API gateway, or WAF. Within 7 days, upgrade all affected components to dd-trace-cpp 2.1.0 or later, rebuild and redeploy the dependent services, and verify the running tracer version in each environment, confirming that DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits are now applied on the extraction path. Within 30 days, formalize a minimum supported dd-trace-cpp version in dependency and image-scanning policy, validate the fix with load and oversized-header testing against representative internet-facing endpoints, add monitoring and alerting for abnormal baggage header sizes and per-request CPU/memory spikes, and confirm no residual instances below 2.1.0 remain in the software inventory.

dd-trace-cpp CVE-2026-50277

EUVD-2026-82423 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-09-17 GitHub_M

Denial Of Service Datadog Dd Trace Cpp

7.5

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach internet-facing service using dd-trace-cpp
Delivery

Craft W3C baggage header with many pairs or huge value
Exploit

Parser allocates unbounded per-request hash map
Execution

Repeat requests to exhaust CPU/memory
Impact

Service denied to legitimate users

Vulnerability Assessment

Weakness	CWE CWE-770 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource allocation limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the target service to (1) use dd-trace-cpp prior to 2.1.0 and (2) have W3C baggage extraction enabled - which is the default unless 'baggage' has been removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT - and (3) be reachable so the attacker-controlled 'baggage' HTTP header is processed on the extraction path. No authentication, user interaction, or special platform is needed (PR:N/UI:N). The primary limiting factors are the default-on-but-disableable baggage config and the relatively niche footprint of the C++ tracer; impact is confined to availability (no data disclosure or modification).
Impact	Signals are consistent and point to a genuine but bounded (DoS-only) risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) aligns cleanly with the description: remote, unauthenticated, low-complexity, no user interaction, availability-only impact. This is not an inflated high-CVSS-but-low-real-risk case - the description, CWE-770 (uncontrolled resource consumption), and source-code diff all corroborate an unbounded allocation on the extraction path. However, no EPSS score is provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced - so this is 'no public exploit identified at time of analysis' rather than active exploitation. The confidentiality/integrity impact is correctly N (pure resource-exhaustion DoS), so it is a lower priority than an RCE at the same 7.5. Real-world urgency is moderated by two factors: the C++ tracer specifically is far less deployed than Datadog's other-language tracers, and exploitation requires baggage extraction to be enabled (default-on) on an internet-facing service. Patch is confirmed available (v2.1.0, commit 422dc91). No conflicting signals were found in the input.
Exploit ScenarioDerived	An attacker sends a single HTTP request to an internet-facing service instrumented with dd-trace-cpp, including a W3C 'baggage' header packed with thousands of comma-separated key-value pairs (or one enormous value). The tracer's extraction path parses the header into a per-request hash map without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS/DD_TRACE_BAGGAGE_MAX_BYTES, spiking CPU and memory; repeating this across many requests exhausts resources and denies service. No public exploit code is identified, but the attack is trivial to reproduce from the description and patch diff.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 17, 2026

Denial of service in Datadog's dd-trace-cpp distributed tracing library prior to 2.1.0: the W3C baggage extraction path parses the attacker-controlled 'baggage' HTTP header without applying the DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits that are already enforced on the injection path. A remote, unauthenticated attacker can send a header containing a very large number of comma-separated key-value pairs, or a single oversized value, to force unbounded hash-map allocation and CPU/memory consumption per request on internet-facing services that use the C++ tracer with baggage extraction enabled (the default unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT). No public exploit identified at time of analysis; impact is availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

RemediationAI

Vendor-released patch: upgrade dd-trace-cpp to version 2.1.0 or later (https://github.com/DataDog/dd-trace-cpp/releases/tag/v2.1.0), which corresponds to upstream commit 422dc91bb93e358e3977381275d311f3f926d666 in PR https://github.com/DataDog/dd-trace-cpp/pull/313 and is documented in advisory GHSA-ch7h-phmx-rqwq. The fix enforces DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, so operators who cannot patch immediately can apply the primary workaround of removing 'baggage' from DD_TRACE_PROPAGATION_STYLE and DD_TRACE_PROPAGATION_STYLE_EXTRACT (or otherwise narrowing propagation styles to tracecontext/datadog only) so the vulnerable parser is never invoked; the trade-off is that inbound baggage key-value context stops being propagated, which can degrade feature-flag targeting, session correlation, or other business context that depends on baggage. As a secondary compensating control, cap accepted HTTP header size at the edge or reverse proxy (e.g., a strict maximum header/field size in nginx, Envoy, or an ingress) to bound the payload an attacker can deliver; the trade-off is that legitimate clients sending unusually large tracing headers may be rejected, and this only limits the per-request cost rather than eliminating the unbounded map growth for headers beneath the cap. Note that no public exploit code was identified at the time of analysis; the referenced PR/commit are the vendor fix, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects remote unauthenticated denial of service with no confidentiality or integrity impact.

Affected VersionsENISA

dd-trace-cpp < 2.1.0

Affected Packages

euvd dd_trace_cpp fix: 2.1.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) issue in dd-trace-cpp, Datadog's C++ distributed tracing library, which implements W3C Trace Context and W3C Baggage propagation. When a request arrives, the tracer's extraction pipeline (Tracer::extract_baggage -> Baggage::extract -> parse_baggage, reached via w3c_propagation.cpp) reads the 'baggage' header through a DictReader and splits it into key-value pairs stored in an unordered_map. Before the fix, parse_baggage accepted the caller's Options on the injection side but used no limits during extraction, so neither max_items nor max_bytes constrained the resulting container; each request could therefore allocate an arbitrarily large map and burn CPU on tokenizing a very long header. CPE cpe:2.3:a:datadog:dd-trace-cpp:*:*:*:*:*:*:*:* with the affected range confirmed by EUVD as dd-trace-cpp < 2.1.0. The upstream fix (PR #313, commit 422dc91bb93e358e3977381275d311f3f926d666) threads Options into Baggage::extract and parse_baggage, rejects the whole header when input.size() > opts.max_bytes, and returns MAXIMUM_CAPACITY_REACHED once the parsed map reaches opts.max_items - the same change also hard-caps the x-datadog-tags header and the 'dd' tracestate entry at 512 bytes as defense in depth for related extraction paths.

Know when Datadog gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Remote unauthenticated attacker sends a crafted header to a default-on extraction path (AV:N/AC:L/PR:N/UI:N); impact is pure resource-exhaustion DoS, so C:N/I:N/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Sep 17, 2026 - 21:19 EUVD

CVE Published

Sep 17, 2026 - 20:16 cve.org

HIGH 7.5

DescriptionCVE.org

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very large value, causing per-request hash-map allocation and unbounded CPU and memory consumption. Baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, so affected internet-facing services can be denied service. This issue is fixed in version 2.1.0.

Technical POC Analysis

Bug class: CWE-770 (Allocation of Resources Without Limits or Throttling) - per the CVE metadata supplied.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Executive ViewAI

Why It Matters

Internet-facing services built on Datadog's dd-trace-cpp tracing library (versions prior to 2.1.0) are exposed to an unauthenticated remote denial-of-service condition that can exhaust CPU and memory and degrade or halt request handling. Because baggage header extraction is enabled by default, any external party who can reach the service can trigger the resource exhaustion without credentials, so the practical exposure spans every customer-facing and partner-facing endpoint running an affected tracer. Leadership should weigh this as an availability and service-reliability risk rather than a data-confidentiality risk, with remediation depending on a library upgrade across all affected services.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.6%

Top 55% exploitable

Prevalence

Medium

Datadog APM widely used, but the C++ tracer is a niche variant (nginx/Envoy modules)

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.6%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.