CVE-2026-50271

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50271", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-04T16:26:05.984Z", "datePublished": "2026-07-17T20:42:34.036Z", "dateUpdated": "2026-07-20T19:16:57.759Z"}, "containers": {"cna": {"title": "dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr"}, {"name": "https://github.com/DataDog/dd-trace-py/pull/17926", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/pull/17926"}, {"name": "https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd"}, {"name": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2"}], "affected": [{"vendor": "DataDog", "product": "dd-trace-py", "versions": [{"version": "< 4.8.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:42:34.036Z"}, "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2."}], "source": {"advisory": "GHSA-mw54-j2v2-42hr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T19:13:27.644496Z", "id": "CVE-2026-50271", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:16:57.759Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50271", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T19:13:27.644496Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:16:37.860Z"}}], "cna": {"title": "dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS", "source": {"advisory": "GHSA-mw54-j2v2-42hr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "DataDog", "product": "dd-trace-py", "versions": [{"status": "affected", "version": "< 4.8.2"}]}], "references": [{"url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr", "name": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/DataDog/dd-trace-py/pull/17926", "name": "https://github.com/DataDog/dd-trace-py/pull/17926", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd", "name": "https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2", "name": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:42:34.036Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50271", "state": "PUBLISHED", "dateUpdated": "2026-07-20T19:16:57.759Z", "dateReserved": "2026-06-04T16:26:05.984Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-17T20:42:34.036Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dd-trace-py", "vendor": "DataDog", "versions": [{"status": "affected", "version": "< 4.8.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2."}, {"lang": "es", "value": "Datadog dd-trace-py es el cliente APM de Python de Datadog. Antes de la versi\u00f3n 4.8.2, las bibliotecas de rastreo de Datadog que implementan la propagaci\u00f3n de equipaje W3C analizan los encabezados HTTP de equipaje entrantes sin aplicar los l\u00edmites DD_TRACE_BAGGAGE_MAX_ITEMS o DD_TRACE_BAGGAGE_MAX_BYTES en la ruta de extracci\u00f3n. Un atacante remoto no autenticado puede enviar una solicitud cuyo encabezado de equipaje contenga un n\u00famero arbitrariamente grande de pares clave-valor separados por comas o un \u00fanico valor muy grande, causando un consumo ilimitado de CPU y memoria y permitiendo una denegaci\u00f3n de servicio remota contra servicios HTTP con la propagaci\u00f3n de equipaje habilitada. Este problema se ha solucionado en la versi\u00f3n 4.8.2."}], "id": "CVE-2026-50271", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50271", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T19:13:27.644496Z", "version": "2.0.3"}}]}, "published": "2026-07-17T21:17:07.070", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/pull/17926"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.8.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "dd-trace-py", "vendor": "datadog"}], "created": "2026-07-22T01:45:15.048859+00:00", "updated": "2026-07-30T23:30:08.676918+00:00", "vendors": ["datadog", "datadog$PRODUCT$dd-trace-py"]}