Skip to content
Threat Feed
Subscribe

Product

Dd-Trace-Py < 4.8.2

1 brief RSS
medium advisory

Datadog dd-trace-py Improper Parsing of W3C Baggage Headers Leads to DoS

The Datadog dd-trace-py tracing library, versions prior to 4.8.2, is vulnerable to a Denial of Service (DoS) attack due to improper parsing of W3C baggage HTTP headers, which fails to enforce item-count or byte-size limits on the extraction path, allowing an unauthenticated attacker to send a request with an arbitrarily large baggage header causing unbounded CPU and memory consumption.

dd-trace-py < 4.8.2 denial-of-service vulnerability python supply-chain
1t