Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

datadog.trace

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetPublished

    dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

    CVE-2026-50273 · GHSA-38wr-vpc7-2mp4

    Affected
    • NuGet datadog.trace < 3.43.0
    Fixed in
    3.43.0· Vendor fix available
    Issue
    Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS (default 64) and DDTRACEBAGGAGEMAXBYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed. Patches This is resolved in…

    Recommended action: Upgrade to 3.43.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →