CVE-2026-50270High· 7.5▾ Twilightdd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
com.datadoghq:dd-java-agent < 1.62.0Patched in:
com.datadoghq:dd-java-agent 1.62.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-50276High· 7.5dd-trace-rb is Datadog's client library for Ruby
CVE-2026-50273High· 7.5dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50274High· 7.5dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50275High· 7.5The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP
CVE-2026-50277High· 7.5dd-trace-cpp is the Datadog distributed tracing library for C++
CVE-2024-12254High· 7.5Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark"