CVE-2026-50273 Details

A denial-of-service vulnerability has been identified in Datadog .NET Tracer versions prior to 3.43.0. The issue arises in tracing libraries that implement W3C baggage propagation, which parse incoming baggage HTTP headers without applying limits on the number of items or the size in bytes during extraction. This oversight allows a remote, unauthenticated attacker to send a baggage header containing an excessive number of comma-separated key-value pairs or a single large value, leading to unbounded CPU and memory usage. The vulnerability is present in services with baggage propagation enabled, which is the default in most affected tracers.

Users can upgrade to Datadog .NET Tracer version 3.43.0 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, W3C baggage extraction can be disabled by removing 'baggage' from the 'DD_TRACE_PROPAGATION_STYLE' environment variable. Alternatively, the maximum HTTP request header size can be capped at an upstream proxy or web server.