CVE-2026-50273

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50273", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-04T16:26:05.984Z", "datePublished": "2026-07-17T18:01:14.533Z", "dateUpdated": "2026-07-17T19:46:45.397Z"}, "containers": {"cna": {"title": "Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4"}, {"name": "https://github.com/DataDog/dd-trace-dotnet/pull/8555", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-dotnet/pull/8555"}, {"name": "https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f"}, {"name": "https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0"}], "affected": [{"vendor": "DataDog", "product": "dd-trace-dotnet", "versions": [{"version": "< 3.43.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T18:01:14.533Z"}, "descriptions": [{"lang": "en", "value": "Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0."}], "source": {"advisory": "GHSA-38wr-vpc7-2mp4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T19:46:28.497491Z", "id": "CVE-2026-50273", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T19:46:45.397Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50273", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T19:46:28.497491Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T19:46:39.733Z"}}], "cna": {"title": "Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS", "source": {"advisory": "GHSA-38wr-vpc7-2mp4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "DataDog", "product": "dd-trace-dotnet", "versions": [{"status": "affected", "version": "< 3.43.0"}]}], "references": [{"url": "https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4", "name": "https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/DataDog/dd-trace-dotnet/pull/8555", "name": "https://github.com/DataDog/dd-trace-dotnet/pull/8555", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f", "name": "https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0", "name": "https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T18:01:14.533Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50273", "state": "PUBLISHED", "dateUpdated": "2026-07-17T19:46:45.397Z", "dateReserved": "2026-06-04T16:26:05.984Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-17T18:01:14.533Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dd-trace-dotnet", "vendor": "DataDog", "versions": [{"status": "affected", "version": "< 3.43.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0."}, {"lang": "es", "value": "Datadog .NET Tracer es una biblioteca cliente para Datadog APM para aplicaciones .NET. Antes de la versi\u00f3n 3.43.0, las bibliotecas de rastreo de Datadog que implementan la propagaci\u00f3n de equipaje W3C analizan los encabezados HTTP de equipaje entrantes sin aplicar DD_TRACE_BAGGAGE_MAX_ITEMS o DD_TRACE_BAGGAGE_MAX_BYTES en la extracci\u00f3n, permitiendo a un atacante remoto no autenticado enviar un encabezado de equipaje con muchos pares clave-valor separados por comas o un valor muy grande y causar un consumo ilimitado de CPU y memoria en servicios con la propagaci\u00f3n de equipaje habilitada. Este problema est\u00e1 solucionado en la versi\u00f3n 3.43.0."}], "id": "CVE-2026-50273", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50273", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T19:46:28.497491Z", "version": "2.0.3"}}]}, "published": "2026-07-17T18:17:16.840", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-dotnet/pull/8555"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.43.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dd-trace-dotnet", "source": "cna", "vendor": "DataDog"}, "product": "dd-trace-dotnet", "vendor": "datadog"}], "created": "2026-07-22T20:00:04.676783+00:00", "updated": "2026-07-31T00:00:06.201484+00:00", "vendors": ["datadog", "datadog$PRODUCT$dd-trace-dotnet"]}