Junglewise Threat Intelligence

CVE-2026-54788: Datadog dd-trace-rs unbounded W3C tracestate parsing DoS

CVE-2026-54788 · Severity: high · CVSS 7.5 · Published 2026-08-28

Executive brief

Datadog's distributed tracing library for Rust fails to limit the size of W3C trace context headers it processes, allowing remote attackers to send oversized or deeply-nested tracestate values that consume unbounded CPU and memory on each request. This causes denial of service on any internet-facing application using the affected library versions, as trace context extraction is enabled by default.

Technical details

The vulnerability exists in the W3C Trace Context (tracecontext) propagation parser in Datadog's dd-trace-rs library. The parser processes the `tracestate` HTTP header, specifically the Datadog vendor entry (`dd=...`), which contains semicolon-separated `key:value` pairs. The library allocates a HashMap entry for each pair without enforcing any size cap on the number of pairs or the total size of the header. A remote, unauthenticated attacker can send a crafted `tracestate` header with an arbitrarily large `dd=` member or an arbitrarily large number of key-value pairs, forcing unbounded CPU and memory allocation per request. This leads to resource exhaustion and denial of service. Since tracecontext extraction is enabled by default in affected versions, any internet-facing service instrumented with versions 0.1.0 through 0.3.2 is exposed unless explicitly disabled. The fix (version 0.3.3) limits parsing to the first 32 tracestate entries.

Affected products

  • Datadog dd-trace-rs >= 0.1.0, < 0.3.3

Timeline

  • 2026-06-22: disclosed
  • 2026-05-05: patched: Fix merged in commit 77c5d18
  • 2026-08-28: advisory

References