Denial of Service Vulnerability in Datadog PHP Tracer

CVE-2026-50275

What is CVE-2026-50275?

The Datadog PHP Tracer, which offers application performance monitoring and distributed tracing for PHP applications, includes a vulnerability where the function ddtrace_deserialize_baggage does not limit the number of W3C baggage HTTP header items parsed. This oversight enables a remote unauthenticated attacker to exploit the system by sending an excessive number of key-value pairs or a disproportionately large value, resulting in uncontrolled consumption of CPU and memory resources on the server. Notably, baggage extraction is typically enabled by default in many deployments unless explicitly configured otherwise, exposing these systems to potential resource exhaustion attacks. The issue has been addressed in version 1.19.2.

References