Executive brief
Datadog's Go tracing library, used for monitoring application performance, contains a flaw in how it processes certain web request headers. An unauthenticated attacker can send specially crafted headers that force the application to consume excessive CPU and memory. This can lead to a denial-of-service (DoS) condition, making the affected web service unavailable to legitimate users.
Technical details
The Datadog dd-trace-go library prior to version 2.8.1 fails to enforce DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits during the extraction of W3C baggage headers. While these limits were enforced during injection, the extraction path in (*propagatorBaggage).extractTextMap would allocate hash-map entries for every key-value pair provided in the header. A remote, unauthenticated attacker can exploit this by sending a request with an arbitrarily large number of comma-separated pairs or a single massive value, leading to unbounded CPU and memory consumption. This results in a Denial of Service (DoS) for any HTTP service where baggage propagation is enabled (which is often the default). The issue is resolved in version 2.8.1.
Affected products
- Datadog dd-trace-go < 2.8.1
Timeline
- 2026-05-04: patched: Fix merged into main branch
- 2026-05-05: other: Version 2.8.1 released
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD