CVE-2026-50274

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50274", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-04T16:26:05.984Z", "datePublished": "2026-07-17T20:41:27.675Z", "dateUpdated": "2026-07-20T15:04:14.809Z"}, "containers": {"cna": {"title": "dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8"}, {"name": "https://github.com/DataDog/dd-trace-go/pull/4720", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-go/pull/4720"}, {"name": "https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df"}, {"name": "https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1"}], "affected": [{"vendor": "DataDog", "product": "dd-trace-go", "versions": [{"version": "< 2.8.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:41:27.675Z"}, "descriptions": [{"lang": "en", "value": "Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1."}], "source": {"advisory": "GHSA-74j5-xf3v-crq8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T15:02:21.456415Z", "id": "CVE-2026-50274", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T15:04:14.809Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50274", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T15:02:21.456415Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T15:02:35.720Z"}}], "cna": {"title": "dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS", "source": {"advisory": "GHSA-74j5-xf3v-crq8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "DataDog", "product": "dd-trace-go", "versions": [{"status": "affected", "version": "< 2.8.1"}]}], "references": [{"url": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8", "name": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/DataDog/dd-trace-go/pull/4720", "name": "https://github.com/DataDog/dd-trace-go/pull/4720", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df", "name": "https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1", "name": "https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:41:27.675Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50274", "state": "PUBLISHED", "dateUpdated": "2026-07-20T15:04:14.809Z", "dateReserved": "2026-06-04T16:26:05.984Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-17T20:41:27.675Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dd-trace-go", "vendor": "DataDog", "versions": [{"status": "affected", "version": "< 2.8.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1."}, {"lang": "es", "value": "Datadog dd-trace-go es una biblioteca cliente Go para la monitorizaci\u00f3n del rendimiento de aplicaciones, la elaboraci\u00f3n de perfiles y la monitorizaci\u00f3n de seguridad de Datadog. Antes de la versi\u00f3n 2.8.1, las bibliotecas de rastreo de Datadog que implementan la propagaci\u00f3n de equipaje W3C analizan los encabezados HTTP de equipaje entrantes sin aplicar los l\u00edmites DD_TRACE_BAGGAGE_MAX_ITEMS o DD_TRACE_BAGGAGE_MAX_BYTES en la ruta de extracci\u00f3n. Un atacante remoto no autenticado puede enviar una solicitud cuyo encabezado de equipaje contiene un n\u00famero arbitrariamente grande de pares clave-valor separados por comas o un \u00fanico valor muy grande, causando un consumo ilimitado de CPU y memoria y permitiendo una denegaci\u00f3n de servicio remota contra servicios HTTP con la propagaci\u00f3n de equipaje habilitada. Este problema est\u00e1 solucionado en la versi\u00f3n 2.8.1."}], "id": "CVE-2026-50274", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50274", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T15:02:21.456415Z", "version": "2.0.3"}}]}, "published": "2026-07-17T21:17:07.337", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-go/pull/4720"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/DataDog/dd-trace-go: Datadog dd-trace-go: Denial of Service via malicious baggage headers", "id": "2501951", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501951"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.", "A flaw was found in Datadog dd-trace-go, a Go client library. A remote, unauthenticated attacker can exploit this vulnerability by sending a request with a specially crafted baggage header containing an arbitrarily large number of key-value pairs or a very large single value. This can lead to unbounded CPU and memory consumption, resulting in a denial of service (DoS) against HTTP services that have baggage propagation enabled."], "mitigation": {"lang": "en:us", "value": "If Datadog APM tracing with W3C baggage propagation is enabled, disable the baggage propagator by setting the DD_TRACE_PROPAGATION_STYLE environment variable to exclude 'baggage'."}, "name": "CVE-2026-50274", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/lighthouse-agent-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/lighthouse-coredns-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-coredns", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-coredns-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-07-17T20:41:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50274\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50274\nhttps://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df\nhttps://github.com/DataDog/dd-trace-go/pull/4720\nhttps://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1\nhttps://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8"], "statement": "Red Hat Advanced Cluster Management for Kubernetes and OpenShift Container Platform 4.21+ ship versions of the Datadog dd-trace-go v2 library prior to v2.8.1 that are vulnerable to this denial-of-service flaw in W3C baggage header parsing. OpenShift Container Platform 4.12 through 4.20 ships dd-trace-go v1, which does not implement W3C baggage propagation and is not affected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.8.1)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "dd-trace-go", "source": "cna", "vendor": "DataDog"}, "product": "dd-trace-java", "vendor": "datadog"}], "created": "2026-07-22T19:45:17.012483+00:00", "updated": "2026-07-30T23:30:08.677451+00:00", "vendors": ["datadog", "datadog$PRODUCT$dd-trace-java"]}