Dd Trace Cpp
Monthly
Denial of service in Datadog's dd-trace-cpp distributed tracing library prior to 2.1.0: the W3C baggage extraction path parses the attacker-controlled 'baggage' HTTP header without applying the DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits that are already enforced on the injection path. A remote, unauthenticated attacker can send a header containing a very large number of comma-separated key-value pairs, or a single oversized value, to force unbounded hash-map allocation and CPU/memory consumption per request on internet-facing services that use the C++ tracer with baggage extraction enabled (the default unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT). No public exploit identified at time of analysis; impact is availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Denial of service in Datadog's dd-trace-cpp distributed tracing library prior to 2.1.0: the W3C baggage extraction path parses the attacker-controlled 'baggage' HTTP header without applying the DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits that are already enforced on the injection path. A remote, unauthenticated attacker can send a header containing a very large number of comma-separated key-value pairs, or a single oversized value, to force unbounded hash-map allocation and CPU/memory consumption per request on internet-facing services that use the C++ tracer with baggage extraction enabled (the default unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT). No public exploit identified at time of analysis; impact is availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).