Unbounded W3C Tracestate Parsing in datadog-opentelemetry

The datadog-opentelemetry Rust library (versions 0.1.0 through 0.3.2) contains a vulnerability in its implementation of W3C Trace Context propagation. The tracer performs unbounded parsing of the tracestate header, specifically when processing the Datadog vendor entry (dd=...). This entry contains semicolon-separated key:value pairs which the library stores in a hash map without enforcing a size limit on the input or the resulting structure.

A remote, unauthenticated attacker can exploit this by sending HTTP requests with a maliciously crafted tracestate header containing an arbitrarily large number of key:value pairs or an excessively large string. Because tracecontext extraction is enabled by default in affected tracers, services using this library are exposed to resource exhaustion. The resulting CPU and memory consumption can lead to a Denial of Service (DoS) for the instrumented application. This issue is tracked as CVE-2026-54788.

Impact

Successful exploitation leads to a remote Denial of Service (DoS) by saturating server CPU and memory. Any internet-facing service instrumented with the vulnerable library versions is at risk, potentially causing service outages or significant performance degradation across affected microservices and backend systems.

Recommendation

1. Upgrade dd-trace-rs to version 0.3.3 or later to apply the necessary input parsing bounds.
2. If an immediate upgrade is not possible, disable tracecontext extraction by setting the DD_TRACE_PROPAGATION_STYLE_EXTRACT environment variable to a value that excludes tracecontext, such as datadog.
3. Implement header size restrictions at the infrastructure level by configuring upstream proxies or web servers to reject requests with excessively large tracestate headers.