Executive brief
Datadog dd-trace-py is a Python library used for monitoring and tracing application performance. A vulnerability in how it handles specific web request headers (W3C baggage) allows an unauthenticated attacker to crash the application or make it unresponsive by sending specially crafted, oversized headers. This can lead to a total service outage, impacting business operations and availability.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the Datadog Python APM client (dd-trace-py) during the extraction of W3C baggage headers. While limits like DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES were enforced during header injection, they were ignored during extraction. An unauthenticated remote attacker can exploit this by sending HTTP requests with excessively large baggage headers or a high volume of key-value pairs. This causes the tracer to perform unbounded memory allocation and CPU-intensive parsing, leading to a Denial of Service (DoS). The vulnerability is present in the default configuration where baggage propagation is enabled. It is fixed in version 4.8.2.
Affected products
- Datadog dd-trace-py < 4.8.2
Timeline
- 2026-05-06: patched: Fix merged into 4.8 branch and released in v4.8.2
- 2026-06-05: advisory: GitHub Security Advisory GHSA-mw54-j2v2-42hr published
- 2026-07-17: disclosed: CVE-2026-50271 published to NVD