Vulnerability-Lookup

CVE-2026-50272 (GCVE-0-2026-50272)

Vulnerability from cvelistv5 – Published: 2026-07-17 20:28 – Updated: 2026-07-21 02:19

Title

dd-trace: Improper parsing of W3C baggage headers may lead to DoS

Summary

dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 02:18 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/DataDog/dd-trace-js/security/a…	x_refsource_CONFIRM
https://github.com/DataDog/dd-trace-js/pull/8255	x_refsource_MISC
https://github.com/DataDog/dd-trace-js/commit/a7d…	x_refsource_MISC
https://github.com/DataDog/dd-trace-js/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
DataDog	dd-trace-js	Affected: < 5.100.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50272",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T02:18:52.275989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T02:19:01.666Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dd-trace-js",
          "vendor": "DataDog",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.100.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T20:28:21.250Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/pull/8255",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/pull/8255"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0"
        }
      ],
      "source": {
        "advisory": "GHSA-wxqq-gcq8-c443",
        "discovery": "UNKNOWN"
      },
      "title": "dd-trace: Improper parsing of W3C baggage headers may lead to DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50272",
    "datePublished": "2026-07-17T20:28:21.250Z",
    "dateReserved": "2026-06-04T16:26:05.984Z",
    "dateUpdated": "2026-07-21T02:19:01.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-50272",
      "date": "2026-09-22",
      "epss": "0.00793",
      "percentile": "0.5483"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "dd-trace-js",
                "vendor": "DataDog",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 5.100.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0."
          }
        ],
        "id": "CVE-2026-50272",
        "lastModified": "2026-07-23T18:06:16.760",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-50272",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T02:18:52.275989Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-17T21:17:07.200",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/DataDog/dd-trace-js/pull/8255"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-50272",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-21T02:18:52.275989Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-21T02:18:58.054Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "dd-trace-js",
              "vendor": "DataDog",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 5.100.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-17T20:28:21.250Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443"
            },
            {
              "name": "https://github.com/DataDog/dd-trace-js/pull/8255",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/DataDog/dd-trace-js/pull/8255"
            },
            {
              "name": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6"
            },
            {
              "name": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0"
            }
          ],
          "source": {
            "advisory": "GHSA-wxqq-gcq8-c443",
            "discovery": "UNKNOWN"
          },
          "title": "dd-trace: Improper parsing of W3C baggage headers may lead to DoS"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-50272",
        "datePublished": "2026-07-17T20:28:21.250Z",
        "dateReserved": "2026-06-04T16:26:05.984Z",
        "dateUpdated": "2026-07-21T02:19:01.666Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2026-GR75196 (CVE-2026-50272)

Vulnerability from cleanstart – Published: 2026-09-18 09:42 – Updated: 2026-08-14 12:25 – Source website

Summary

Security fix for CVE-2026-50272 applied in: langfuse-worker 3.194.1-r1

Details

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-50272	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-50272	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "langfuse-worker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.194.1-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2026-GR75196",
  "modified": "2026-08-14T12:25:42Z",
  "published": "2026-09-18T09:42:01.774808Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GR75196.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-50272"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50272"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fix for CVE-2026-50272 applied in: langfuse-worker 3.194.1-r1",
  "upstream": [
    "CVE-2026-50272"
  ]
}

CLEANSTART-2026-YR55628 (GHSA-FRVP-7C67-39W9)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in langfuse-worker 3.194.1-r1

Details

Package langfuse-worker version 3.194.1-r1 fixes 30 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, CVE-2026-50272, ghsa-55q2-fjhq-7xh7, CVE-2026-65898...

References

URL

Type

https://github.com/langfuse/langfuse

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "langfuse-worker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.194.1-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.194.1-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package langfuse-worker version 3.194.1-r1 fixes 30 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, CVE-2026-50272, ghsa-55q2-fjhq-7xh7, CVE-2026-65898...",
  "id": "CLEANSTART-2026-YR55628",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langfuse/langfuse"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in langfuse-worker 3.194.1-r1",
  "upstream": [
    "ghsa-frvp-7c67-39w9",
    "ghsa-p63j-vcc4-9vmv",
    "CVE-2026-50272",
    "ghsa-55q2-fjhq-7xh7",
    "CVE-2026-65898",
    "ghsa-c2j3-45gr-mqc4",
    "CVE-2026-69192",
    "CVE-2026-54272",
    "CVE-2026-69198",
    "CVE-2026-50159",
    "CVE-2026-71436",
    "CVE-2026-71437",
    "CVE-2026-71439",
    "CVE-2026-71438",
    "CVE-2026-67214",
    "CVE-2026-67213",
    "ghsa-7rqj-j65f-68wh",
    "ghsa-xmf8-cvqr-rfgj",
    "ghsa-x445-f3h2-j279",
    "CVE-2026-73419",
    "CVE-2026-73418",
    "CVE-2026-73420",
    "ghsa-r28c-9q8g-f849",
    "CVE-2026-69153",
    "ghsa-f88m-g3jw-g9cj",
    "CVE-2026-13697",
    "CVE-2026-14643",
    "CVE-2026-15157",
    "CVE-2026-16728",
    "CVE-2026-16729"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

FKIE_CVE-2026-50272

Vulnerability from fkie_nvd - Published: 2026-07-17 21:17 - Updated: 2026-07-23 18:06

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6
	security-advisories@github.com	https://github.com/DataDog/dd-trace-js/pull/8255
	security-advisories@github.com	https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0
	security-advisories@github.com	https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "dd-trace-js",
          "vendor": "DataDog",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.100.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0."
    }
  ],
  "id": "CVE-2026-50272",
  "lastModified": "2026-07-23T18:06:16.760",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-50272",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-21T02:18:52.275989Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-17T21:17:07.200",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DataDog/dd-trace-js/pull/8255"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-WXQQ-GCQ8-C443

Vulnerability from github – Published: 2026-07-15 22:58 – Updated: 2026-07-15 22:58

Summary

dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

Details

Impact

Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.

Patches

This is resolved in version 5.100.0 and later of the dd-trace-js library.

Workarounds

If users cannot upgrade immediately: 1. Disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently). 2. Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb).

Resources

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "dd-trace"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.100.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50272"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-15T22:58:52Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled.\nThe baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.\n\n### Patches\nThis is resolved in version 5.100.0 and later of the `dd-trace-js` library.\n\n### Workarounds\nIf users cannot upgrade immediately:\n1. Disable `baggage` extraction by removing `baggage` from `DD_TRACE_PROPAGATION_STYLE` (or `DD_TRACE_PROPAGATION_STYLE_EXTRACT` if set independently).\n2. Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache `LimitRequestFieldSize`, Nginx `large_client_header_buffers`, Envoy `max_request_headers_kb`).\n\n\n### Resources\nRelated upstream advisories:\n[opentelemetry-go GHSA-mh2q-q3fh-2475](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475)\n[opentelemetry-dotnet GHSA-g94r-2vxg-569j](https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j)",
  "id": "GHSA-wxqq-gcq8-c443",
  "modified": "2026-07-15T22:58:52Z",
  "published": "2026-07-15T22:58:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DataDog/dd-trace-js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-50272 (GCVE-0-2026-50272)

CLEANSTART-2026-GR75196 (CVE-2026-50272)

CLEANSTART-2026-YR55628 (GHSA-FRVP-7C67-39W9)

FKIE_CVE-2026-50272

GHSA-WXQQ-GCQ8-C443

Impact

Patches

Workarounds

Resources

Tags

Sightings

Nomenclature

Related by attack behaviour