CVE-2026-54788: Datadog dd-trace-rs unbounded W3C tracestate parsing DoS

CVE-2026-54788 · Severity: high · CVSS 7.5 · Published 2026-08-28

Datadog's distributed tracing library for Rust fails to limit the size of W3C trace context headers it processes, allowing remote attackers to send oversized or deeply-nested tracestate values that consume unbounded CPU and memory on each request. This causes denial of service on any internet-facing application using the affected library versions, as trace context extraction is enabled by default.

Vendors: crates.io, Datadog.

Quick answers

Is CVE-2026-54788 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54788 being exploited in the wild.
How severe is CVE-2026-54788?
High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?
datadog-opentelemetry (crates.io) >= 0.1.0, < 0.3.3, SEMVER:introduced=0.1.0,fixed=0.3.3; Datadog Dd-Trace-Rs >= 0.1.0, < 0.3.3.
Is there a fix for CVE-2026-54788?
Yes. datadog-opentelemetry (crates.io): upgrade to 0.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54788 attacked?
It is attacked over the network.
Am I affected by CVE-2026-54788?
Check whether you run datadog-opentelemetry (crates.io) or Datadog Dd-Trace-Rs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • datadog-opentelemetry (crates.io): upgrade to 0.3.3 or later
    cargo update -p datadog-opentelemetry

Technical details

The vulnerability exists in the W3C Trace Context (tracecontext) propagation parser in Datadog's dd-trace-rs library. The parser processes the `tracestate` HTTP header, specifically the Datadog vendor entry (`dd=...`), which contains semicolon-separated `key:value` pairs. The library allocates a HashMap entry for each pair without enforcing any size cap on the number of pairs or the total size of the header. A remote, unauthenticated attacker can send a crafted `tracestate` header with an arbitrarily large `dd=` member or an arbitrarily large number of key-value pairs, forcing unbounded CPU and memory allocation per request. This leads to resource exhaustion and denial of service. Since tracecontext extraction is enabled by default in affected versions, any internet-facing service instrumented with versions 0.1.0 through 0.3.2 is exposed unless explicitly disabled. The fix (version 0.3.3) limits parsing to the first 32 tracestate entries.

Affected products

  • Datadog dd-trace-rs >= 0.1.0, < 0.3.3

Identifiers

  • CVE-2026-54788
  • GHSA-gpwf-4h98-v82q

Timeline

  • 2026-06-22: disclosed
  • 2026-05-05: patched: Fix merged in commit 77c5d18
  • 2026-08-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.