DataDog dd-trace-go up to 2.8.0 Baggage Propagation denial of service

Summaryinfo

A vulnerability was found in DataDog dd-trace-go up to 2.8.0 and classified as problematic. Impacted is an unknown function of the component Baggage Propagation. Executing a manipulation can lead to denial of service. This vulnerability appears as CVE-2026-50274. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in DataDog dd-trace-go up to 2.8.0. It has been declared as problematic. This vulnerability affects an unknown code of the component Baggage Propagation. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.

The advisory is available at github.com. This vulnerability was named CVE-2026-50274 since 06/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 2.8.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-45328). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Network Management Software

Vendor

• DataDog

Name

• dd-trace-go

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8.0

Website

• Product: https://github.com/DataDog/dd-trace-go/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion