Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
52 vulnerabilities by DataDog
CVE-2026-50277 (GCVE-0-2026-50277)
Vulnerability from nvd – Published: 2026-09-17 20:16 – Updated: 2026-09-21 21:12
VLAI
EPSS
VEX
Title
dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very large value, causing per-request hash-map allocation and unbounded CPU and memory consumption. Baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, so affected internet-facing services can be denied service. This issue is fixed in version 2.1.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 21:12 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-cpp/security/… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-cpp/pull/313 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-cpp/commit/42… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-cpp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-cpp |
Affected:
< 2.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50277",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T21:12:22.481903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T21:12:32.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-cpp",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very large value, causing per-request hash-map allocation and unbounded CPU and memory consumption. Baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, so affected internet-facing services can be denied service. This issue is fixed in version 2.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T20:16:37.230Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-ch7h-phmx-rqwq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-ch7h-phmx-rqwq"
},
{
"name": "https://github.com/DataDog/dd-trace-cpp/pull/313",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-cpp/pull/313"
},
{
"name": "https://github.com/DataDog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666"
},
{
"name": "https://github.com/DataDog/dd-trace-cpp/releases/tag/v2.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-cpp/releases/tag/v2.1.0"
}
],
"source": {
"advisory": "GHSA-ch7h-phmx-rqwq",
"discovery": "UNKNOWN"
},
"title": "dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50277",
"datePublished": "2026-09-17T20:16:37.230Z",
"dateReserved": "2026-06-04T16:26:05.985Z",
"dateUpdated": "2026-09-21T21:12:32.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50275 (GCVE-0-2026-50275)
Vulnerability from nvd – Published: 2026-09-17 20:04 – Updated: 2026-09-18 20:08
VLAI
EPSS
VEX
Title
Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
Summary
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send an arbitrarily large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate hash-map entries and consume unbounded CPU and memory on each request. Baggage extraction is enabled by default in most affected deployments unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT. This issue is fixed in version 1.19.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:08 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-php/security/… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-php/pull/3854 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-php/commit/2f… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-php/commit/43… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-php/releases/… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-php/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-php |
Affected:
< 1.19.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50275",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:08:34.736084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:08:45.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-php",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 1.19.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send an arbitrarily large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate hash-map entries and consume unbounded CPU and memory on each request. Baggage extraction is enabled by default in most affected deployments unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT. This issue is fixed in version 1.19.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T20:04:26.605Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-php/security/advisories/GHSA-phwx-ww2p-cv9v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-php/security/advisories/GHSA-phwx-ww2p-cv9v"
},
{
"name": "https://github.com/DataDog/dd-trace-php/pull/3854",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/pull/3854"
},
{
"name": "https://github.com/DataDog/dd-trace-php/commit/2f7987eb02e306bb62bce8ec4152dece68112f51",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/commit/2f7987eb02e306bb62bce8ec4152dece68112f51"
},
{
"name": "https://github.com/DataDog/dd-trace-php/commit/43072ccafe55a5dbdfba75a42bf316b4150ae1e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/commit/43072ccafe55a5dbdfba75a42bf316b4150ae1e5"
},
{
"name": "https://github.com/DataDog/dd-trace-php/releases/tag/1.19.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/releases/tag/1.19.2"
},
{
"name": "https://github.com/DataDog/dd-trace-php/releases/tag/1.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/releases/tag/1.20.0"
}
],
"source": {
"advisory": "GHSA-phwx-ww2p-cv9v",
"discovery": "UNKNOWN"
},
"title": "Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50275",
"datePublished": "2026-09-17T20:04:26.605Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-09-18T20:08:45.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50276 (GCVE-0-2026-50276)
Vulnerability from nvd – Published: 2026-09-14 17:04 – Updated: 2026-09-14 17:38
VLAI
EPSS
VEX
Title
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 2.32.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 17:37 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-rb/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-rb/pull/5672 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-rb/commit/361… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-rb/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-rb |
Affected:
< 2.32.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50276",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T17:37:49.381563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:38:12.401Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-rb",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 2.32.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-rb is Datadog\u0027s client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 2.32.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:04:52.744Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98"
},
{
"name": "https://github.com/DataDog/dd-trace-rb/pull/5672",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rb/pull/5672"
},
{
"name": "https://github.com/DataDog/dd-trace-rb/commit/361947090214488778ac4f144e219426ffcf92e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rb/commit/361947090214488778ac4f144e219426ffcf92e6"
},
{
"name": "https://github.com/DataDog/dd-trace-rb/releases/tag/v2.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rb/releases/tag/v2.32.0"
}
],
"source": {
"advisory": "GHSA-p5f6-rccc-jv98",
"discovery": "UNKNOWN"
},
"title": "dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50276",
"datePublished": "2026-09-14T17:04:52.744Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-09-14T17:38:12.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50270 (GCVE-0-2026-50270)
Vulnerability from nvd – Published: 2026-09-14 17:03 – Updated: 2026-09-14 19:16
VLAI
EPSS
VEX
Title
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:16 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-java/security… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-java/pull/11265 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-java/commit/1… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-java/releases… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-java |
Affected:
< 1.62.0
|
|
| com.datadoghq | dd-java-agent |
Affected:
< 1.62.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50270",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:16:34.436361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:16:55.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-java",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 1.62.0"
}
]
},
{
"product": "dd-java-agent",
"vendor": "com.datadoghq",
"versions": [
{
"status": "affected",
"version": "\u003c 1.62.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:03:39.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-74xj-wh4w-vqxc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-74xj-wh4w-vqxc"
},
{
"name": "https://github.com/DataDog/dd-trace-java/pull/11265",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/pull/11265"
},
{
"name": "https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757"
},
{
"name": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.62.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.62.0"
}
],
"source": {
"advisory": "GHSA-74xj-wh4w-vqxc",
"discovery": "UNKNOWN"
},
"title": "dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50270",
"datePublished": "2026-09-14T17:03:39.809Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-09-14T19:16:55.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54788 (GCVE-0-2026-54788)
Vulnerability from nvd – Published: 2026-08-28 16:33 – Updated: 2026-08-31 18:57
VLAI
EPSS
VEX
Title
dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
Summary
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:57 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-rs/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-rs/pull/218 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-rs/commit/77c… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-rs/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-rs |
Affected:
>= 0.1.0, < 0.3.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54788",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:57:04.416602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:57:14.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-rs",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:33:49.032Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-rs/security/advisories/GHSA-gpwf-4h98-v82q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-rs/security/advisories/GHSA-gpwf-4h98-v82q"
},
{
"name": "https://github.com/DataDog/dd-trace-rs/pull/218",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rs/pull/218"
},
{
"name": "https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71d0ea8103da0e6cf4cd50677ffacd2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71d0ea8103da0e6cf4cd50677ffacd2"
},
{
"name": "https://github.com/DataDog/dd-trace-rs/releases/tag/datadog-opentelemetry-v0.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rs/releases/tag/datadog-opentelemetry-v0.3.3"
}
],
"source": {
"advisory": "GHSA-gpwf-4h98-v82q",
"discovery": "UNKNOWN"
},
"title": "dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54788",
"datePublished": "2026-08-28T16:33:49.032Z",
"dateReserved": "2026-06-15T23:23:57.714Z",
"dateUpdated": "2026-08-31T18:57:14.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47364 (GCVE-0-2026-47364)
Vulnerability from nvd – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.
Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:34 UTC
CWE
- CWE-200 - Information Disclosure
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-47364",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:34:32.439927Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:35:34.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user\u0027s Datadog UUID, with no user-facing opt-out.\r\n\r\nImpact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog\u0027s own systems."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.273Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"url": "https://firebase.google.com/docs/crashlytics/customize-crash-reports?platform=android#enable-opt-in-reporting"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-47364",
"datePublished": "2026-08-07T18:02:35.142Z",
"dateReserved": "2026-05-19T15:00:09.319Z",
"dateUpdated": "2026-08-08T01:05:53.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47363 (GCVE-0-2026-47363)
Vulnerability from nvd – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend.
This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app.
Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:33 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-47363",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:33:35.578365Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:34:02.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend.\r\nThis requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim\u0027s app.\r\nImpact: A co-installed application can switch the victim\u0027s Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim\u0027s existing session or data."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "CWE-926 Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.203Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/926.html"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-47363",
"datePublished": "2026-08-07T18:02:35.043Z",
"dateReserved": "2026-05-19T15:00:09.319Z",
"dateUpdated": "2026-08-08T01:05:53.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47362 (GCVE-0-2026-47362)
Vulnerability from nvd – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history).
Impact: Any actor able to bypass the app sandbox can read these databases in plaintext.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:28 UTC
CWE
- CWE-922 - Insecure Storage of Sensitive Information
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.4 , < 5.9.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-47362",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:28:11.214660Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:28:47.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.4",
"status": "affected",
"version": "5.9.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user\u0027s full in-app search history). \r\nImpact: Any actor able to bypass the app sandbox can read these databases in plaintext."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-922",
"description": "CWE-922 Insecure Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.195Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/922.html"
},
{
"url": "https://www.zetetic.net/sqlcipher/sqlcipher-for-android/"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-47362",
"datePublished": "2026-08-07T18:02:34.902Z",
"dateReserved": "2026-05-19T15:00:09.319Z",
"dateUpdated": "2026-08-08T01:05:53.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47361 (GCVE-0-2026-47361)
Vulnerability from nvd – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller's identity or ownership of the conversation.
This requires a malicious application co-installed on the victim's device.
Impact: A co-installed application can silently dismiss the victim's Bits AI chat notification. No chat content is exposed; conversation data remains server-authentication gated and is never returned to the caller.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:30 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-47361",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:30:54.209702Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:31:50.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller\u0027s identity or ownership of the conversation.\r\nThis requires a malicious application co-installed on the victim\u0027s device.\r\nImpact: A co-installed application can silently dismiss the victim\u0027s Bits AI chat notification. No chat content is exposed; conversation data remains server-authentication gated and is never returned to the caller."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "CWE-926 Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.248Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/926.html"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-47361",
"datePublished": "2026-08-07T18:02:34.957Z",
"dateReserved": "2026-05-19T15:00:09.319Z",
"dateUpdated": "2026-08-08T01:05:53.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44965 (GCVE-0-2026-44965)
Vulnerability from nvd – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) are exported with no permission guard. Each accepts a caller-supplied AppWidgetManager.EXTRA_APPWIDGET_ID and, when no deep-link destination is resolved, uses it to load the matching widget's stored session and automatically log in as that user. Because Android widget IDs are small sequential integers, a co-installed application can brute-force this value to find one that matches a widget configured on the victim's device.
This requires:
A malicious application co-installed on the victim's device.
At least one of the six widgets configured on the victim's home screen.
An active Datadog session cached locally.
Impact: The matching configuration activity opens in the foreground under the victim's session and renders live infrastructure data. Exposure is limited to a visual side channel (e.g., screen recording or accessibility services); the calling application cannot programmatically read the rendered data.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:38 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-44965",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:38:34.010393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:39:11.036Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) are exported with no permission guard. Each accepts a caller-supplied AppWidgetManager.EXTRA_APPWIDGET_ID and, when no deep-link destination is resolved, uses it to load the matching widget\u0027s stored session and automatically log in as that user. Because Android widget IDs are small sequential integers, a co-installed application can brute-force this value to find one that matches a widget configured on the victim\u0027s device.\r\nThis requires:\r\nA malicious application co-installed on the victim\u0027s device.\r\nAt least one of the six widgets configured on the victim\u0027s home screen.\r\nAn active Datadog session cached locally.\r\nImpact: The matching configuration activity opens in the foreground under the victim\u0027s session and renders live infrastructure data. Exposure is limited to a visual side channel (e.g., screen recording or accessibility services); the calling application cannot programmatically read the rendered data."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "CWE-926 Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.332Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/926.html"
},
{
"url": "https://developer.android.com/develop/ui/views/appwidgets/configuration"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-44965",
"datePublished": "2026-08-07T18:02:35.165Z",
"dateReserved": "2026-05-08T15:00:02.447Z",
"dateUpdated": "2026-08-08T01:05:53.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44964 (GCVE-0-2026-44964)
Vulnerability from nvd – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.
This requires:
A malicious application co-installed on the victim's device.
An active Datadog session in the Android app.
Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:36 UTC
CWE
- CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-44964",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:36:41.651155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:37:01.344Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.\r\nThis requires:\r\nA malicious application co-installed on the victim\u0027s device.\r\nAn active Datadog session in the Android app.\r\nImpact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim\u0027s session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441 Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.334Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://developer.android.com/guide/topics/manifest/activity-element#exported"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-44964",
"datePublished": "2026-08-07T18:02:35.145Z",
"dateReserved": "2026-05-08T15:00:02.447Z",
"dateUpdated": "2026-08-08T01:05:53.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50274 (GCVE-0-2026-50274)
Vulnerability from nvd – Published: 2026-07-17 20:41 – Updated: 2026-07-20 15:04
VLAI
EPSS
VEX
Title
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
Summary
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 15:02 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-go/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-go/pull/4720 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-go/commit/192… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-go/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-go |
Affected:
< 2.8.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50274",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T15:02:21.456415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:04:14.809Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-go",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 2.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T20:41:27.675Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8"
},
{
"name": "https://github.com/DataDog/dd-trace-go/pull/4720",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-go/pull/4720"
},
{
"name": "https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df"
},
{
"name": "https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1"
}
],
"source": {
"advisory": "GHSA-74j5-xf3v-crq8",
"discovery": "UNKNOWN"
},
"title": "dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50274",
"datePublished": "2026-07-17T20:41:27.675Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-07-20T15:04:14.809Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50272 (GCVE-0-2026-50272)
Vulnerability from nvd – Published: 2026-07-17 20:28 – Updated: 2026-07-21 02:19
VLAI
EPSS
VEX
Title
dd-trace: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 02:18 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-js/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-js/pull/8255 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-js/commit/a7d… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-js/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-js |
Affected:
< 5.100.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T02:18:52.275989Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:19:01.666Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-js",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 5.100.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T20:28:21.250Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443"
},
{
"name": "https://github.com/DataDog/dd-trace-js/pull/8255",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-js/pull/8255"
},
{
"name": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6"
},
{
"name": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0"
}
],
"source": {
"advisory": "GHSA-wxqq-gcq8-c443",
"discovery": "UNKNOWN"
},
"title": "dd-trace: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50272",
"datePublished": "2026-07-17T20:28:21.250Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-07-21T02:19:01.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50271 (GCVE-0-2026-50271)
Vulnerability from nvd – Published: 2026-07-17 20:42 – Updated: 2026-07-20 19:16
VLAI
EPSS
VEX
Title
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
Summary
Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 19:13 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-py/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-py/pull/17926 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-py/commit/9c8… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-py/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-py |
Affected:
< 4.8.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50271",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T19:13:27.644496Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:16:57.759Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-py",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 4.8.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T20:42:34.036Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr"
},
{
"name": "https://github.com/DataDog/dd-trace-py/pull/17926",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-py/pull/17926"
},
{
"name": "https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd"
},
{
"name": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2"
}
],
"source": {
"advisory": "GHSA-mw54-j2v2-42hr",
"discovery": "UNKNOWN"
},
"title": "dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50271",
"datePublished": "2026-07-17T20:42:34.036Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-07-20T19:16:57.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50273 (GCVE-0-2026-50273)
Vulnerability from nvd – Published: 2026-07-17 18:01 – Updated: 2026-07-17 19:46
VLAI
EPSS
VEX
Title
Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
Summary
Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 19:46 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-dotnet/securi… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-dotnet/pull/8555 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-dotnet/commit… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-dotnet/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-dotnet |
Affected:
< 3.43.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50273",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T19:46:28.497491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T19:46:45.397Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-dotnet",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 3.43.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T18:01:14.533Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4"
},
{
"name": "https://github.com/DataDog/dd-trace-dotnet/pull/8555",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-dotnet/pull/8555"
},
{
"name": "https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f"
},
{
"name": "https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0"
}
],
"source": {
"advisory": "GHSA-38wr-vpc7-2mp4",
"discovery": "UNKNOWN"
},
"title": "Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50273",
"datePublished": "2026-07-17T18:01:14.533Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-07-17T19:46:45.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50277 (GCVE-0-2026-50277)
Vulnerability from cvelistv5 – Published: 2026-09-17 20:16 – Updated: 2026-09-21 21:12
VLAI
EPSS
VEX
Title
dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very large value, causing per-request hash-map allocation and unbounded CPU and memory consumption. Baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, so affected internet-facing services can be denied service. This issue is fixed in version 2.1.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 21:12 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-cpp/security/… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-cpp/pull/313 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-cpp/commit/42… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-cpp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-cpp |
Affected:
< 2.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50277",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T21:12:22.481903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T21:12:32.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-cpp",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very large value, causing per-request hash-map allocation and unbounded CPU and memory consumption. Baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, so affected internet-facing services can be denied service. This issue is fixed in version 2.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T20:16:37.230Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-ch7h-phmx-rqwq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-ch7h-phmx-rqwq"
},
{
"name": "https://github.com/DataDog/dd-trace-cpp/pull/313",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-cpp/pull/313"
},
{
"name": "https://github.com/DataDog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666"
},
{
"name": "https://github.com/DataDog/dd-trace-cpp/releases/tag/v2.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-cpp/releases/tag/v2.1.0"
}
],
"source": {
"advisory": "GHSA-ch7h-phmx-rqwq",
"discovery": "UNKNOWN"
},
"title": "dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50277",
"datePublished": "2026-09-17T20:16:37.230Z",
"dateReserved": "2026-06-04T16:26:05.985Z",
"dateUpdated": "2026-09-21T21:12:32.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50275 (GCVE-0-2026-50275)
Vulnerability from cvelistv5 – Published: 2026-09-17 20:04 – Updated: 2026-09-18 20:08
VLAI
EPSS
VEX
Title
Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
Summary
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send an arbitrarily large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate hash-map entries and consume unbounded CPU and memory on each request. Baggage extraction is enabled by default in most affected deployments unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT. This issue is fixed in version 1.19.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:08 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-php/security/… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-php/pull/3854 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-php/commit/2f… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-php/commit/43… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-php/releases/… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-php/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-php |
Affected:
< 1.19.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50275",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:08:34.736084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:08:45.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-php",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 1.19.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send an arbitrarily large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate hash-map entries and consume unbounded CPU and memory on each request. Baggage extraction is enabled by default in most affected deployments unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT. This issue is fixed in version 1.19.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T20:04:26.605Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-php/security/advisories/GHSA-phwx-ww2p-cv9v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-php/security/advisories/GHSA-phwx-ww2p-cv9v"
},
{
"name": "https://github.com/DataDog/dd-trace-php/pull/3854",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/pull/3854"
},
{
"name": "https://github.com/DataDog/dd-trace-php/commit/2f7987eb02e306bb62bce8ec4152dece68112f51",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/commit/2f7987eb02e306bb62bce8ec4152dece68112f51"
},
{
"name": "https://github.com/DataDog/dd-trace-php/commit/43072ccafe55a5dbdfba75a42bf316b4150ae1e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/commit/43072ccafe55a5dbdfba75a42bf316b4150ae1e5"
},
{
"name": "https://github.com/DataDog/dd-trace-php/releases/tag/1.19.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/releases/tag/1.19.2"
},
{
"name": "https://github.com/DataDog/dd-trace-php/releases/tag/1.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-php/releases/tag/1.20.0"
}
],
"source": {
"advisory": "GHSA-phwx-ww2p-cv9v",
"discovery": "UNKNOWN"
},
"title": "Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50275",
"datePublished": "2026-09-17T20:04:26.605Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-09-18T20:08:45.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50276 (GCVE-0-2026-50276)
Vulnerability from cvelistv5 – Published: 2026-09-14 17:04 – Updated: 2026-09-14 17:38
VLAI
EPSS
VEX
Title
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 2.32.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 17:37 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-rb/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-rb/pull/5672 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-rb/commit/361… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-rb/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-rb |
Affected:
< 2.32.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50276",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T17:37:49.381563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:38:12.401Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-rb",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 2.32.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-rb is Datadog\u0027s client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 2.32.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:04:52.744Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98"
},
{
"name": "https://github.com/DataDog/dd-trace-rb/pull/5672",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rb/pull/5672"
},
{
"name": "https://github.com/DataDog/dd-trace-rb/commit/361947090214488778ac4f144e219426ffcf92e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rb/commit/361947090214488778ac4f144e219426ffcf92e6"
},
{
"name": "https://github.com/DataDog/dd-trace-rb/releases/tag/v2.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rb/releases/tag/v2.32.0"
}
],
"source": {
"advisory": "GHSA-p5f6-rccc-jv98",
"discovery": "UNKNOWN"
},
"title": "dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50276",
"datePublished": "2026-09-14T17:04:52.744Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-09-14T17:38:12.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50270 (GCVE-0-2026-50270)
Vulnerability from cvelistv5 – Published: 2026-09-14 17:03 – Updated: 2026-09-14 19:16
VLAI
EPSS
VEX
Title
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:16 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-java/security… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-java/pull/11265 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-java/commit/1… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-java/releases… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-java |
Affected:
< 1.62.0
|
|
| com.datadoghq | dd-java-agent |
Affected:
< 1.62.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50270",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:16:34.436361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:16:55.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-java",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 1.62.0"
}
]
},
{
"product": "dd-java-agent",
"vendor": "com.datadoghq",
"versions": [
{
"status": "affected",
"version": "\u003c 1.62.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:03:39.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-74xj-wh4w-vqxc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-74xj-wh4w-vqxc"
},
{
"name": "https://github.com/DataDog/dd-trace-java/pull/11265",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/pull/11265"
},
{
"name": "https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757"
},
{
"name": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.62.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.62.0"
}
],
"source": {
"advisory": "GHSA-74xj-wh4w-vqxc",
"discovery": "UNKNOWN"
},
"title": "dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50270",
"datePublished": "2026-09-14T17:03:39.809Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-09-14T19:16:55.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54788 (GCVE-0-2026-54788)
Vulnerability from cvelistv5 – Published: 2026-08-28 16:33 – Updated: 2026-08-31 18:57
VLAI
EPSS
VEX
Title
dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
Summary
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:57 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-rs/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-rs/pull/218 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-rs/commit/77c… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-rs/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-rs |
Affected:
>= 0.1.0, < 0.3.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54788",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:57:04.416602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:57:14.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-rs",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:33:49.032Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-rs/security/advisories/GHSA-gpwf-4h98-v82q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-rs/security/advisories/GHSA-gpwf-4h98-v82q"
},
{
"name": "https://github.com/DataDog/dd-trace-rs/pull/218",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rs/pull/218"
},
{
"name": "https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71d0ea8103da0e6cf4cd50677ffacd2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71d0ea8103da0e6cf4cd50677ffacd2"
},
{
"name": "https://github.com/DataDog/dd-trace-rs/releases/tag/datadog-opentelemetry-v0.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-rs/releases/tag/datadog-opentelemetry-v0.3.3"
}
],
"source": {
"advisory": "GHSA-gpwf-4h98-v82q",
"discovery": "UNKNOWN"
},
"title": "dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54788",
"datePublished": "2026-08-28T16:33:49.032Z",
"dateReserved": "2026-06-15T23:23:57.714Z",
"dateUpdated": "2026-08-31T18:57:14.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44965 (GCVE-0-2026-44965)
Vulnerability from cvelistv5 – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) are exported with no permission guard. Each accepts a caller-supplied AppWidgetManager.EXTRA_APPWIDGET_ID and, when no deep-link destination is resolved, uses it to load the matching widget's stored session and automatically log in as that user. Because Android widget IDs are small sequential integers, a co-installed application can brute-force this value to find one that matches a widget configured on the victim's device.
This requires:
A malicious application co-installed on the victim's device.
At least one of the six widgets configured on the victim's home screen.
An active Datadog session cached locally.
Impact: The matching configuration activity opens in the foreground under the victim's session and renders live infrastructure data. Exposure is limited to a visual side channel (e.g., screen recording or accessibility services); the calling application cannot programmatically read the rendered data.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:38 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-44965",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:38:34.010393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:39:11.036Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) are exported with no permission guard. Each accepts a caller-supplied AppWidgetManager.EXTRA_APPWIDGET_ID and, when no deep-link destination is resolved, uses it to load the matching widget\u0027s stored session and automatically log in as that user. Because Android widget IDs are small sequential integers, a co-installed application can brute-force this value to find one that matches a widget configured on the victim\u0027s device.\r\nThis requires:\r\nA malicious application co-installed on the victim\u0027s device.\r\nAt least one of the six widgets configured on the victim\u0027s home screen.\r\nAn active Datadog session cached locally.\r\nImpact: The matching configuration activity opens in the foreground under the victim\u0027s session and renders live infrastructure data. Exposure is limited to a visual side channel (e.g., screen recording or accessibility services); the calling application cannot programmatically read the rendered data."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "CWE-926 Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.332Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/926.html"
},
{
"url": "https://developer.android.com/develop/ui/views/appwidgets/configuration"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-44965",
"datePublished": "2026-08-07T18:02:35.165Z",
"dateReserved": "2026-05-08T15:00:02.447Z",
"dateUpdated": "2026-08-08T01:05:53.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44964 (GCVE-0-2026-44964)
Vulnerability from cvelistv5 – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.
This requires:
A malicious application co-installed on the victim's device.
An active Datadog session in the Android app.
Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:36 UTC
CWE
- CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-44964",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:36:41.651155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:37:01.344Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.\r\nThis requires:\r\nA malicious application co-installed on the victim\u0027s device.\r\nAn active Datadog session in the Android app.\r\nImpact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim\u0027s session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441 Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.334Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://developer.android.com/guide/topics/manifest/activity-element#exported"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-44964",
"datePublished": "2026-08-07T18:02:35.145Z",
"dateReserved": "2026-05-08T15:00:02.447Z",
"dateUpdated": "2026-08-08T01:05:53.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47364 (GCVE-0-2026-47364)
Vulnerability from cvelistv5 – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.
Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:34 UTC
CWE
- CWE-200 - Information Disclosure
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-47364",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:34:32.439927Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:35:34.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user\u0027s Datadog UUID, with no user-facing opt-out.\r\n\r\nImpact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog\u0027s own systems."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.273Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"url": "https://firebase.google.com/docs/crashlytics/customize-crash-reports?platform=android#enable-opt-in-reporting"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-47364",
"datePublished": "2026-08-07T18:02:35.142Z",
"dateReserved": "2026-05-19T15:00:09.319Z",
"dateUpdated": "2026-08-08T01:05:53.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47363 (GCVE-0-2026-47363)
Vulnerability from cvelistv5 – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend.
This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app.
Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:33 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-47363",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:33:35.578365Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:34:02.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend.\r\nThis requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim\u0027s app.\r\nImpact: A co-installed application can switch the victim\u0027s Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim\u0027s existing session or data."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "CWE-926 Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.203Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/926.html"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-47363",
"datePublished": "2026-08-07T18:02:35.043Z",
"dateReserved": "2026-05-19T15:00:09.319Z",
"dateUpdated": "2026-08-08T01:05:53.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47361 (GCVE-0-2026-47361)
Vulnerability from cvelistv5 – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller's identity or ownership of the conversation.
This requires a malicious application co-installed on the victim's device.
Impact: A co-installed application can silently dismiss the victim's Bits AI chat notification. No chat content is exposed; conversation data remains server-authentication gated and is never returned to the caller.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:30 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.2 , < 5.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-47361",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:30:54.209702Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:31:50.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller\u0027s identity or ownership of the conversation.\r\nThis requires a malicious application co-installed on the victim\u0027s device.\r\nImpact: A co-installed application can silently dismiss the victim\u0027s Bits AI chat notification. No chat content is exposed; conversation data remains server-authentication gated and is never returned to the caller."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "CWE-926 Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.248Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/926.html"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-47361",
"datePublished": "2026-08-07T18:02:34.957Z",
"dateReserved": "2026-05-19T15:00:09.319Z",
"dateUpdated": "2026-08-08T01:05:53.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47362 (GCVE-0-2026-47362)
Vulnerability from cvelistv5 – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05
VLAI
EPSS
VEX
Summary
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history).
Impact: Any actor able to bypass the app sandbox can read these databases in plaintext.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:28 UTC
CWE
- CWE-922 - Insecure Storage of Sensitive Information
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Datadog | Android App |
Affected:
5.9.4 , < 5.9.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-47362",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:28:11.214660Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:28:47.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App",
"vendor": "Datadog",
"versions": [
{
"lessThan": "5.9.4",
"status": "affected",
"version": "5.9.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mark Esler (https://github.com/eslerm)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user\u0027s full in-app search history). \r\nImpact: Any actor able to bypass the app sandbox can read these databases in plaintext."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-922",
"description": "CWE-922 Insecure Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T01:05:53.195Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://cwe.mitre.org/data/definitions/922.html"
},
{
"url": "https://www.zetetic.net/sqlcipher/sqlcipher-for-android/"
},
{
"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-47362",
"datePublished": "2026-08-07T18:02:34.902Z",
"dateReserved": "2026-05-19T15:00:09.319Z",
"dateUpdated": "2026-08-08T01:05:53.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50271 (GCVE-0-2026-50271)
Vulnerability from cvelistv5 – Published: 2026-07-17 20:42 – Updated: 2026-07-20 19:16
VLAI
EPSS
VEX
Title
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
Summary
Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 19:13 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-py/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-py/pull/17926 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-py/commit/9c8… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-py/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-py |
Affected:
< 4.8.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50271",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T19:13:27.644496Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:16:57.759Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-py",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 4.8.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T20:42:34.036Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr"
},
{
"name": "https://github.com/DataDog/dd-trace-py/pull/17926",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-py/pull/17926"
},
{
"name": "https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd"
},
{
"name": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2"
}
],
"source": {
"advisory": "GHSA-mw54-j2v2-42hr",
"discovery": "UNKNOWN"
},
"title": "dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50271",
"datePublished": "2026-07-17T20:42:34.036Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-07-20T19:16:57.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50274 (GCVE-0-2026-50274)
Vulnerability from cvelistv5 – Published: 2026-07-17 20:41 – Updated: 2026-07-20 15:04
VLAI
EPSS
VEX
Title
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
Summary
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 15:02 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-go/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-go/pull/4720 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-go/commit/192… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-go/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-go |
Affected:
< 2.8.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50274",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T15:02:21.456415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:04:14.809Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-go",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 2.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T20:41:27.675Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8"
},
{
"name": "https://github.com/DataDog/dd-trace-go/pull/4720",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-go/pull/4720"
},
{
"name": "https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df"
},
{
"name": "https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1"
}
],
"source": {
"advisory": "GHSA-74j5-xf3v-crq8",
"discovery": "UNKNOWN"
},
"title": "dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50274",
"datePublished": "2026-07-17T20:41:27.675Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-07-20T15:04:14.809Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50272 (GCVE-0-2026-50272)
Vulnerability from cvelistv5 – Published: 2026-07-17 20:28 – Updated: 2026-07-21 02:19
VLAI
EPSS
VEX
Title
dd-trace: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 02:18 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-js/security/a… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-js/pull/8255 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-js/commit/a7d… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-js/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-js |
Affected:
< 5.100.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T02:18:52.275989Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:19:01.666Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-js",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 5.100.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T20:28:21.250Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443"
},
{
"name": "https://github.com/DataDog/dd-trace-js/pull/8255",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-js/pull/8255"
},
{
"name": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6"
},
{
"name": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0"
}
],
"source": {
"advisory": "GHSA-wxqq-gcq8-c443",
"discovery": "UNKNOWN"
},
"title": "dd-trace: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50272",
"datePublished": "2026-07-17T20:28:21.250Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-07-21T02:19:01.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50273 (GCVE-0-2026-50273)
Vulnerability from cvelistv5 – Published: 2026-07-17 18:01 – Updated: 2026-07-17 19:46
VLAI
EPSS
VEX
Title
Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
Summary
Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 19:46 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-dotnet/securi… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-dotnet/pull/8555 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-dotnet/commit… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-dotnet/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-dotnet |
Affected:
< 3.43.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50273",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T19:46:28.497491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T19:46:45.397Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-dotnet",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 3.43.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T18:01:14.533Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4"
},
{
"name": "https://github.com/DataDog/dd-trace-dotnet/pull/8555",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-dotnet/pull/8555"
},
{
"name": "https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f"
},
{
"name": "https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0"
}
],
"source": {
"advisory": "GHSA-38wr-vpc7-2mp4",
"discovery": "UNKNOWN"
},
"title": "Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50273",
"datePublished": "2026-07-17T18:01:14.533Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-07-17T19:46:45.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}