CVE-2026-50274
Description
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.
How to fix
- github.com/DataDog/dd-trace-go/v22.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/DataDog/dd-trace-goGo | v ≤ 1.24.1, No range specified | — |
| github.com/DataDog/dd-trace-go/v2Go | v < 2.8.1 | 2.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.