Executive brief
The Datadog PHP Tracer is a performance monitoring extension used to track application performance and trace distributed requests across services. A remote attacker can send specially crafted HTTP headers to trigger unbounded memory and CPU consumption, potentially causing the application to become unresponsive or crash. This affects deployments with baggage extraction enabled (the default configuration), and no authentication is required to exploit the vulnerability.
Technical details
The vulnerability is a denial-of-service flaw in W3C baggage header parsing within the ddtrace_deserialize_baggage function in ext/distributed_tracing_headers.c. The parser fails to enforce the DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES configuration limits, allowing attackers to send requests with an arbitrarily large number of comma-separated key-value pairs or single oversized values. This causes the tracer to allocate unbounded memory and consume excessive CPU on each malicious request. Baggage extraction is enabled by default unless explicitly disabled via DD_TRACE_PROPAGATION_STYLE configuration. The fix was implemented in version 1.19.2 to properly enforce size and item count limits.
Affected products
- Datadog PHP Tracer before 1.19.2
Timeline
- 2026-09-17: disclosed
- 2026-05-06: patched: Fix implemented in version 1.19.2