Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

datadog-opentelemetry

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5crates.ioAmendedPublished

    datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

    CVE-2026-54788 · GHSA-gpwf-4h98-v82q

    Affected
    • crates.io datadog-opentelemetry >= 0.1.0, < 0.3.3
    Fixed in
    0.3.3· Vendor fix available
    Issue
    Impact Datadog tracing libraries that implement W3C Trace Context (tracecontext) propagation parse the incoming tracestate header without enforcing a size cap on the Datadog vendor entry (dd=...). The dd= value contains semicolon-separated key:value pairs, and the parser allocates a hash-map entry for each pair. A remote, unauthenticated attacker can send a tracestate header whose dd= member is arbitrarily large (or contains an arbitrarily large number of pairs), forcing unbounded CPU and memory consumption per request and enabling a remote Denial of Service. tracecontext extraction is enabled by default in affected tracers, so any internet-facing service instrumented with an affected version is exposed unless tracecontext has been explicitly removed from the propagation style configuration. Patches This is resolved in version 0.3.3 and later of the dd-trace-rs library. Workarounds If you cannot upgrade immediately: 1. Disable tracecontext extraction by setting…

    Recommended action: Upgrade to 0.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →