# CVE-2026-50277: Datadog dd-trace-cpp denial of service in baggage header extraction

Source: https://junglewise.ai/threats/cve-2026-50277-datadog-dd-trace-cpp-denial-of-service-in-baggage-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-50277 · Severity: high · CVSS 7.5 · Published 2026-09-17

dd-trace-cpp is Datadog's distributed tracing library for C++ applications. The library fails to enforce size limits when parsing incoming W3C baggage headers, allowing attackers to send maliciously crafted headers with many key-value pairs or very large values. This causes unbounded memory and CPU consumption on receiving services, leading to service unavailability—a significant risk for internet-facing applications relying on the tracer.

Vendors: [Datadog](https://junglewise.ai/threats/vendors/datadog).

## Quick answers

**Is CVE-2026-50277 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50277 being exploited in the wild.

**How severe is CVE-2026-50277?** High severity, with a CVSS score of 7.5, published 17 September 2026.

**Which products and versions are affected?** Datadog Dd-Trace-Cpp before 2.1.0.

**Is there a fix for CVE-2026-50277?** A patch was published on 2026-05-04: Fix merged in version 2.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50277 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50277?** Check whether you run Datadog Dd-Trace-Cpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service flaw in baggage header parsing (CWE-770: allocation of resources without limits or throttling). Prior to version 2.1.0, dd-trace-cpp extracts W3C baggage headers without enforcing the DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits that are applied during injection. An unauthenticated remote attacker can craft headers with numerous comma-separated key-value pairs or extremely large values, triggering per-request hash-map allocations and exhausting memory and CPU. Baggage extraction is enabled by default in most tracers unless explicitly disabled via DD_TRACE_PROPAGATION_STYLE configuration. The fix is available in version 2.1.0, which applies the same limits to extraction as injection.

## Affected products

- Datadog dd-trace-cpp before 2.1.0

## Timeline

- 2026-09-17: disclosed
- 2026-05-04: patched: Fix merged in version 2.1.0

## References

- [https://github.com/DataDog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666](https://github.com/DataDog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666)
- [https://github.com/DataDog/dd-trace-cpp/pull/313](https://github.com/DataDog/dd-trace-cpp/pull/313)