Denial of Service Vulnerability in Datadog Application Performance Monitoring Library

CVE-2026-50274

What is CVE-2026-50274?

The Datadog dd-trace-go library, used for application performance monitoring, is susceptible to a denial of service vulnerability prior to version 2.8.1. It fails to limit the size and number of key-value pairs in incoming baggage HTTP headers, which an unauthenticated attacker can exploit. By sending specially crafted requests containing numerous or excessively large baggage items, malicious users can trigger significant CPU and memory usage, potentially leading to service disruptions. This vulnerability emphasizes the importance of implementing strict size limitations on user-supplied data to prevent outages.

References