CVE-2026-50273: Datadog .NET Tracer Denial of Service in W3C baggage parsing

CVE-2026-50273 · Severity: high · CVSS 7.5 · Published 2026-07-17

Datadog .NET Tracer is a tool used by developers to monitor the performance and health of .NET applications. A security flaw in this library allows an unauthenticated attacker to crash or slow down an application by sending specially crafted web requests. This could lead to a service outage (Denial of Service), impacting business operations and customer availability.

Vendors: Datadog, NuGet.

Quick answers

Is CVE-2026-50273 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50273 being exploited in the wild.
How severe is CVE-2026-50273?
High severity, with a CVSS score of 7.5, published 17 July 2026.
Which products and versions are affected?
Datadog Dd-Trace-Dotnet < 3.43.0; Datadog.Trace (NuGet) < 3.43.0, ECOSYSTEM:introduced=0,fixed=3.43.0; Datadog.Trace.OpenTracing (NuGet) < 3.43.0, ECOSYSTEM:introduced=0,fixed=3.43.0.
Is there a fix for CVE-2026-50273?
Yes. Datadog.Trace (NuGet): upgrade to 3.43.0 or later; Datadog.Trace.OpenTracing (NuGet): upgrade to 3.43.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50273 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50273?
Check whether you run Datadog Dd-Trace-Dotnet, Datadog.Trace (NuGet) or Datadog.Trace.OpenTracing (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Datadog.Trace (NuGet): upgrade to 3.43.0 or later
    dotnet add package Datadog.Trace --version 3.43.0
  • Datadog.Trace.OpenTracing (NuGet): upgrade to 3.43.0 or later
    dotnet add package Datadog.Trace.OpenTracing --version 3.43.0

Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Datadog .NET Tracer library's implementation of W3C baggage propagation. The library fails to enforce 'DD_TRACE_BAGGAGE_MAX_ITEMS' or 'DD_TRACE_BAGGAGE_MAX_BYTES' limits during the extraction of incoming HTTP baggage headers. A remote, unauthenticated attacker can exploit this by sending a request with a baggage header containing an excessive number of key-value pairs or a single very large value, leading to unbounded CPU and memory consumption. This issue is enabled by default in most configurations and is fixed in version 3.43.0. Workarounds include disabling baggage extraction or limiting header sizes at an upstream proxy.

Affected products

  • Datadog dd-trace-dotnet < 3.43.0
  • Datadog Datadog.Trace < 3.43.0
  • Datadog Datadog.Trace.OpenTracing < 3.43.0

Identifiers

  • CVE-2026-50273
  • GHSA-38wr-vpc7-2mp4

Timeline

  • 2026-05-04: patched: Fix merged in pull request #8555
  • 2026-06-05: advisory: GitHub Security Advisory GHSA-38wr-vpc7-2mp4 published
  • 2026-07-17: disclosed: CVE-2026-50273 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.