---
id: CVE-2026-54788
title: dd-trace-rs provides Datadog application performance monitoring for Rust
summary: >-
  dd-trace-rs provides Datadog application performance monitoring for Rust. From
  0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs
  parses the W3C tracestate header and collects every semicolon-separated key
  and value…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: datadog-opentelemetry
product: datadog-opentelemetry
affected:
  - 'datadog-opentelemetry >= 0.1.0, < 0.3.3'
patched:
  - datadog-opentelemetry 0.3.3
published: '2026-08-28'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54788'
references:
  - url: >-
      https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71d0ea8103da0e6cf4cd50677ffacd2
    label: security-advisories@github.com
  - url: 'https://github.com/DataDog/dd-trace-rs/pull/218'
    label: security-advisories@github.com
  - url: >-
      https://github.com/DataDog/dd-trace-rs/releases/tag/datadog-opentelemetry-v0.3.3
    label: security-advisories@github.com
  - url: >-
      https://github.com/DataDog/dd-trace-rs/security/advisories/GHSA-gpwf-4h98-v82q
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-gpwf-4h98-v82q'
tags:
  - nvd
  - ghsa
  - rust
epss: 0.00793
epssPercentile: 0.54493
aliases:
  - GHSA-gpwf-4h98-v82q
ecosystem: rust
ingestedAt: '2026-08-28T17:22:56.604Z'
---

## Overview

dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54788)

Affected packages:

- `datadog-opentelemetry >= 0.1.0, < 0.3.3`

Patched in:

- `datadog-opentelemetry 0.3.3`

Source: https://github.com/advisories/GHSA-gpwf-4h98-v82q