Executive brief
Datadog .NET Tracer is a tool used by developers to monitor the performance and health of .NET applications. A security flaw in this library allows an unauthenticated attacker to crash or slow down an application by sending specially crafted web requests. This could lead to a service outage (Denial of Service), impacting business operations and customer availability.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the Datadog .NET Tracer library's implementation of W3C baggage propagation. The library fails to enforce 'DD_TRACE_BAGGAGE_MAX_ITEMS' or 'DD_TRACE_BAGGAGE_MAX_BYTES' limits during the extraction of incoming HTTP baggage headers. A remote, unauthenticated attacker can exploit this by sending a request with a baggage header containing an excessive number of key-value pairs or a single very large value, leading to unbounded CPU and memory consumption. This issue is enabled by default in most configurations and is fixed in version 3.43.0. Workarounds include disabling baggage extraction or limiting header sizes at an upstream proxy.
Affected products
- Datadog dd-trace-dotnet < 3.43.0
- Datadog Datadog.Trace < 3.43.0
- Datadog Datadog.Trace.OpenTracing < 3.43.0
Timeline
- 2026-05-04: patched: Fix merged in pull request #8555
- 2026-06-05: advisory: GitHub Security Advisory GHSA-38wr-vpc7-2mp4 published
- 2026-07-17: disclosed: CVE-2026-50273 published to NVD