Denial of Service Vulnerability in Datadog Application Performance Monitoring for Rust
CVE-2026-54788

7.5HIGH

Key Information:

Vendor

Datadog

Status
Dd-trace-rs
Vendor
CVE Published:
28 August 2026

What is CVE-2026-54788?

The dd-trace-rs library from DataDog, which provides application performance monitoring for Rust applications, is vulnerable due to improper parsing of the W3C tracestate header. Versions 0.1.0 to 0.3.2 allow a remote unauthenticated attacker to exploit this vulnerability by sending an excessively large dd=... entry. This could lead to high CPU and memory usage, ultimately causing a denial of service for the affected service. The issue has been addressed in version 0.3.3.

Affected Version(s)

dd-trace-rs >= 0.1.0, < 0.3.3

References

https://github.com/DataDog/dd-trace-rs/security/advisorie...
x_refsource_CONFIRM
https://github.com/DataDog/dd-trace-rs/pull/218
x_refsource_MISC
https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.