CVE-2026-50271 Details
Description
Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.
A denial-of-service vulnerability has been identified in Datadog dd-trace-py, the Python APM client for Datadog. Prior to version 4.8.2, the library's W3C baggage propagation implementation allowed incoming baggage HTTP headers to be parsed without applying limits on the number of items or the total byte size. This oversight enabled remote, unauthenticated attackers to send headers with excessive key-value pairs or large values, leading to unrestrained CPU and memory usage. As a result, HTTP services with baggage propagation enabled could experience a remote denial-of-service condition.
Users can upgrade to version 4.8.2 or later, where this vulnerability is fixed. If an immediate upgrade is not possible, the 'baggage' extraction can be disabled by removing it from the 'DD_TRACE_PROPAGATION_STYLE' or 'DD_TRACE_PROPAGATION_STYLE_EXTRACT' settings. Additionally, upstream proxies or web servers can be configured to limit the maximum HTTP request header size.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |