Is CVE-2026-50275 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50275 being exploited in the wild.

How severe is CVE-2026-50275?

High severity, with a CVSS score of 7.5, published 17 September 2026.

Which products and versions are affected?

Datadog PHP Tracer before 1.19.2.

Is there a fix for CVE-2026-50275?

A patch was published on 2026-05-06: Fix implemented in version 1.19.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50275 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50275?

Check whether you run Datadog PHP Tracer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50275: Datadog PHP Tracer denial of service via unbounded baggage parsing

CVE-2026-50275 · Severity: high · CVSS 7.5 · Published 2026-09-17

The Datadog PHP Tracer is a performance monitoring extension used to track application performance and trace distributed requests across services. A remote attacker can send specially crafted HTTP headers to trigger unbounded memory and CPU consumption, potentially causing the application to become unresponsive or crash. This affects deployments with baggage extraction enabled (the default configuration), and no authentication is required to exploit the vulnerability.

Vendors: Datadog.

Quick answers

Is CVE-2026-50275 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50275 being exploited in the wild.
How severe is CVE-2026-50275?: High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?: Datadog PHP Tracer before 1.19.2.
Is there a fix for CVE-2026-50275?: A patch was published on 2026-05-06: Fix implemented in version 1.19.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50275 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50275?: Check whether you run Datadog PHP Tracer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial-of-service flaw in W3C baggage header parsing within the ddtrace_deserialize_baggage function in ext/distributed_tracing_headers.c. The parser fails to enforce the DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES configuration limits, allowing attackers to send requests with an arbitrarily large number of comma-separated key-value pairs or single oversized values. This causes the tracer to allocate unbounded memory and consume excessive CPU on each malicious request. Baggage extraction is enabled by default unless explicitly disabled via DD_TRACE_PROPAGATION_STYLE configuration. The fix was implemented in version 1.19.2 to properly enforce size and item count limits.

Affected products

Datadog PHP Tracer before 1.19.2

Timeline

2026-09-17: disclosed
2026-05-06: patched: Fix implemented in version 1.19.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.