CVE-2026-50271
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
The dd-trace-py (Python) library for Datadog does not enforce limits on the number or size of items in W3C baggage headers during extraction. A remote, unauthenticated attacker can send a request with an arbitrarily large number of key-value pairs or a single very large value, causing unbounded CPU and memory consumption.
Risk Assessment
The organization is at risk of remote denial of service (DoS) in HTTP applications using baggage propagation, potentially disrupting monitored services.
Recommendation
Update dd-trace-py to version 4.8.2 or later, which introduces DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits.
Other vulnerabilities in dd-trace-py
See all- CVE-2026-116589High
Datadog dd-trace-py, the Datadog Python APM client, from 3.13.0 until 4.15.5 does not properly handle certain internal errors in IAST string-processing instrumentation when old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling.
- CVE-2026-116588High
Datadog dd-trace-py, the Datadog Python APM client, from 1.5.0 until 3.19.9 and 4.15.6 has a default query-string obfuscation regular expression that can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability.
Original NVD description (English source)
Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS