Denial of Service Vulnerability in Datadog APM Client for Java

CVE-2026-50270

What is CVE-2026-50270?

The Datadog APM client for Java, specifically prior to version 1.62.0, is susceptible to a denial of service due to deficiencies in W3C baggage extraction. The default configuration allows remote unauthenticated attackers to send baggage HTTP headers that can lead to significant unbounded CPU and memory consumption. This occurs because the extraction process allocates map entries during parsing of attacker-controlled headers for every request, which enables the possibility of overwhelming an HTTP service, especially when baggage propagation is enabled. The issue has been addressed in version 1.62.0.

References