{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/datadog/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["go/github.com/DataDog/dd-trace-go (\u003c= 1.24.1)","go/github.com/DataDog/dd-trace-go/v2 (\u003c 2.8.1)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","supply-chain","go","datadog"],"_cs_type":"advisory","_cs_vendors":["Datadog"],"content_html":"\u003cp\u003eA high-severity vulnerability, identified as CVE-2026-50274, exists in the Datadog \u003ccode\u003edd-trace-go\u003c/code\u003e tracing libraries, specifically versions 1.x (up to 1.24.1) and 2.x (up to 2.8.0). This flaw stems from improper parsing of incoming W3C baggage HTTP headers, where the libraries fail to enforce item-count or byte-size limits during the extraction process. The default limits (DD_TRACE_BAGGAGE_MAX_ITEMS=64, DD_TRACE_BAGGAGE_MAX_BYTES=8192) are only applied during baggage injection, not extraction. This oversight allows a remote, unauthenticated attacker to send specially crafted HTTP requests containing an arbitrarily large number of comma-separated key-value pairs or a single very large value within the baggage header. This malicious input causes the tracer to allocate an excessive number of hash-map entries for each request, leading to unbounded CPU and memory consumption, ultimately resulting in a Denial of Service (DoS) against any HTTP service instrumented with the affected tracer version where baggage propagation is enabled by default.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker crafts an HTTP request targeting an internet-facing service instrumented with a vulnerable \u003ccode\u003edd-trace-go\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003eThe attacker includes a W3C \u003ccode\u003ebaggage\u003c/code\u003e HTTP header in the request containing an exceptionally large number of comma-separated key-value pairs or a single, very large value.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003edd-trace-go\u003c/code\u003e library, upon receiving the request, attempts to parse and extract the W3C baggage header.\u003c/li\u003e\n\u003cli\u003eDue to the lack of item-count or byte-size limits during extraction, the tracer allocates a hash-map entry for each key-value pair.\u003c/li\u003e\n\u003cli\u003eThis unbounded allocation leads to significant and continuous increases in the service's CPU utilization and memory consumption.\u003c/li\u003e\n\u003cli\u003eThe sustained resource exhaustion prevents the service from processing legitimate requests, resulting in a Denial of Service (DoS).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-50274 leads to a Denial of Service (DoS) condition on affected HTTP services. Attackers can remotely trigger unbounded CPU and memory consumption, causing the service to become unresponsive or crash. This impacts the availability of critical applications that rely on the \u003ccode\u003edd-trace-go\u003c/code\u003e library for distributed tracing, potentially disrupting business operations and hindering monitoring capabilities. The vulnerability affects services that have baggage propagation style enabled by default or explicitly configured.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-50274 immediately by upgrading \u003ccode\u003edd-trace-go\u003c/code\u003e to version 2.8.1 or later. For those using \u003ccode\u003edd-trace-go\u003c/code\u003e 1.x, the recommendation is to migrate to \u003ccode\u003ev2.8.1\u003c/code\u003e or newer.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade to \u003ccode\u003edd-trace-go\u003c/code\u003e version 2.8.1 is not feasible, disable \u003ccode\u003ebaggage\u003c/code\u003e extraction by removing \u003ccode\u003ebaggage\u003c/code\u003e from the \u003ccode\u003eDD_TRACE_PROPAGATION_STYLE\u003c/code\u003e environment variable. Alternatively, if \u003ccode\u003eDD_TRACE_PROPAGATION_STYLE_EXTRACT\u003c/code\u003e is set independently, remove \u003ccode\u003ebaggage\u003c/code\u003e from its value.\u003c/li\u003e\n\u003cli\u003eAs an additional mitigation, cap the maximum HTTP request header size at an upstream proxy or web server. Refer to documentation for Apache (\u003ccode\u003eLimitRequestFieldSize\u003c/code\u003e), Nginx (\u003ccode\u003elarge_client_header_buffers\u003c/code\u003e), or Envoy (\u003ccode\u003emax_request_headers_kb\u003c/code\u003e) to configure appropriate limits for HTTP header sizes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-15T23:06:22Z","date_published":"2026-07-15T23:06:22Z","id":"https://feed.craftedsignal.io/briefs/2026-07-dd-trace-go-dos/","summary":"A vulnerability, CVE-2026-50274, in Datadog's `dd-trace-go` library (versions \u003c= 1.24.1 and v2 \u003c 2.8.1) allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending HTTP requests with oversized W3C baggage headers, leading to unbounded CPU and memory consumption in instrumented services.","title":"Datadog dd-trace-go Library Vulnerability May Lead to Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-07-dd-trace-go-dos/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["dd-trace-js (\u003c 5.100.0)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","javascript","nodejs","datadog"],"_cs_type":"advisory","_cs_vendors":["Datadog"],"content_html":"\u003cp\u003eA high-severity Denial of Service (DoS) vulnerability, tracked as CVE-2026-50272, affects Datadog's \u003ccode\u003edd-trace-js\u003c/code\u003e library in versions prior to 5.100.0. This flaw stems from the library's improper parsing of W3C baggage HTTP headers. While limits (\u003ccode\u003eDD_TRACE_BAGGAGE_MAX_ITEMS\u003c/code\u003e and \u003ccode\u003eDD_TRACE_BAGGAGE_MAX_BYTES\u003c/code\u003e) are enforced during baggage injection, they are not applied during extraction. This allows a remote, unauthenticated attacker to craft and send HTTP requests containing an arbitrarily large number of comma-separated key-value pairs or a single very large value within the \u003ccode\u003ebaggage\u003c/code\u003e header. When a vulnerable service receives such a request, the \u003ccode\u003edd-trace-js\u003c/code\u003e tracer attempts to allocate a hash-map entry for each pair, leading to unbounded consumption of CPU and memory resources, ultimately resulting in a Denial of Service. The baggage propagation style, which enables this vulnerability, is often enabled by default in affected tracers, making internet-facing services instrumented with these versions particularly susceptible.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eAttacker crafts malicious HTTP request\u003c/strong\u003e: A remote, unauthenticated attacker constructs an HTTP request targeting an internet-facing service instrumented with \u003ccode\u003edd-trace-js\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInjects oversized W3C baggage header\u003c/strong\u003e: The attacker inserts a W3C \u003ccode\u003ebaggage\u003c/code\u003e HTTP header into the request, containing an exceptionally large number of comma-separated key-value pairs or a single, extremely long value.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRequest sent to vulnerable service\u003c/strong\u003e: The malicious HTTP request is transmitted to the target service.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerable \u003ccode\u003edd-trace-js\u003c/code\u003e receives request\u003c/strong\u003e: The service, running a vulnerable version of \u003ccode\u003edd-trace-js\u003c/code\u003e (prior to 5.100.0) with baggage propagation enabled by default, receives the request.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImproper header parsing occurs\u003c/strong\u003e: The \u003ccode\u003edd-trace-js\u003c/code\u003e library attempts to extract the baggage items from the oversized header without enforcing any item-count or byte-size limits on the extraction path.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eResource exhaustion\u003c/strong\u003e: The library continuously allocates hash-map entries for each perceived key-value pair, leading to unbounded consumption of CPU and memory resources.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDenial of Service\u003c/strong\u003e: The target service becomes unresponsive or crashes due to resource exhaustion, resulting in a Denial of Service for legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-50272 leads to a Denial of Service (DoS) against HTTP services that are instrumented with vulnerable versions of the \u003ccode\u003edd-trace-js\u003c/code\u003e library (prior to 5.100.0). Attackers can trigger this by sending a crafted HTTP request with an oversized W3C baggage header, causing the tracer to consume unbounded CPU and memory resources. This resource exhaustion can crash the targeted service, making it unavailable to legitimate users. Any internet-facing service utilizing the affected library with the baggage propagation style enabled (which is often the default configuration) is at risk, potentially leading to significant service disruption and operational downtime.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003edd-trace-js\u003c/code\u003e library to version \u003ccode\u003e5.100.0\u003c/code\u003e or later immediately to patch CVE-2026-50272.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not feasible, disable \u003ccode\u003ebaggage\u003c/code\u003e extraction by modifying \u003ccode\u003eDD_TRACE_PROPAGATION_STYLE\u003c/code\u003e or \u003ccode\u003eDD_TRACE_PROPAGATION_STYLE_EXTRACT\u003c/code\u003e to remove \u003ccode\u003ebaggage\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement upstream proxy or web server configurations to cap the maximum HTTP request header size. For example, configure Apache \u003ccode\u003eLimitRequestFieldSize\u003c/code\u003e, Nginx \u003ccode\u003elarge_client_header_buffers\u003c/code\u003e, or Envoy \u003ccode\u003emax_request_headers_kb\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-15T22:59:58Z","date_published":"2026-07-15T22:59:58Z","id":"https://feed.craftedsignal.io/briefs/2026-07-dd-trace-js-dos/","summary":"The Datadog `dd-trace-js` library, specifically versions older than 5.100.0, is vulnerable to a Denial of Service (DoS) attack where improper parsing of W3C baggage HTTP headers allows a remote, unauthenticated attacker to send requests with an arbitrarily large number of comma-separated key-value pairs, leading to unbounded CPU and memory consumption and enabling a remote DoS against any HTTP service instrumented with the affected library where baggage propagation is enabled.","title":"Datadog dd-trace-js W3C Baggage Header Denial of Service Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-dd-trace-js-dos/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["dd-java-agent (\u003c 1.62.0)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","java","vulnerability","w3c","datadog"],"_cs_type":"advisory","_cs_vendors":["Datadog"],"content_html":"\u003cp\u003eA high-severity denial-of-service vulnerability, tracked as CVE-2026-50270, affects Datadog's \u003ccode\u003edd-trace-java\u003c/code\u003e library versions prior to 1.62.0. This flaw stems from improper parsing of W3C baggage HTTP headers without enforcing item-count or byte-size limits during the extraction process. While limits exist for baggage injection, they are not applied during extraction. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing an oversized or malformed W3C \u003ccode\u003ebaggage\u003c/code\u003e header. This malicious header, when processed by the vulnerable tracer, triggers unbounded CPU and memory consumption as the library attempts to allocate hash-map entries for each of the numerous key-value pairs, leading to a denial of service against any internet-facing HTTP service instrumented with the affected \u003ccode\u003edd-trace-java\u003c/code\u003e versions. W3C baggage propagation is often enabled by default, increasing the attack surface.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies an internet-facing Java application instrumented with a vulnerable \u003ccode\u003edd-trace-java\u003c/code\u003e version (prior to 1.62.0) that has W3C baggage propagation enabled.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request, including a W3C \u003ccode\u003ebaggage\u003c/code\u003e header containing an excessively large number of comma-separated key-value pairs or a single extremely long value.\u003c/li\u003e\n\u003cli\u003eThe crafted HTTP request is sent by the attacker to the target application's exposed HTTP endpoint.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003edd-trace-java\u003c/code\u003e library intercepts the incoming request and attempts to parse the malformed \u003ccode\u003ebaggage\u003c/code\u003e header for distributed tracing propagation.\u003c/li\u003e\n\u003cli\u003eDue to the lack of item-count or byte-size limits on the extraction path, the library consumes an unbounded amount of CPU and memory resources while processing the oversized header.\u003c/li\u003e\n\u003cli\u003eThis uncontrolled resource consumption leads to significant CPU utilization and memory exhaustion on the application server.\u003c/li\u003e\n\u003cli\u003eThe server's resources are depleted, resulting in a denial-of-service condition, making the application unresponsive and unavailable to legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-50270 results in a remote denial-of-service (DoS) against affected HTTP services. Attackers can render applications unresponsive and unavailable to legitimate users by consuming all available CPU and memory resources. Since the vulnerability is exploitable by remote, unauthenticated attackers, it poses a significant risk to any internet-facing service utilizing \u003ccode\u003edd-trace-java\u003c/code\u003e versions prior to 1.62.0, especially when W3C baggage propagation is enabled by default. There are no reported specific victim counts or sectors, but any organization using the vulnerable library is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003edd-trace-java\u003c/code\u003e library to version 1.62.0 or later immediately to patch CVE-2026-50270.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, disable \u003ccode\u003ebaggage\u003c/code\u003e extraction by removing \u003ccode\u003ebaggage\u003c/code\u003e from the \u003ccode\u003eDD_TRACE_PROPAGATION_STYLE\u003c/code\u003e environment variable (or \u003ccode\u003eDD_TRACE_PROPAGATION_STYLE_EXTRACT\u003c/code\u003e if set independently).\u003c/li\u003e\n\u003cli\u003eImplement maximum HTTP request header size limits at an upstream proxy or web server (e.g., Apache's \u003ccode\u003eLimitRequestFieldSize\u003c/code\u003e, Nginx's \u003ccode\u003elarge_client_header_buffers\u003c/code\u003e, or Envoy's \u003ccode\u003emax_request_headers_kb\u003c/code\u003e) as a compensatory control against oversized W3C baggage headers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-15T22:55:01Z","date_published":"2026-07-15T22:55:01Z","id":"https://feed.craftedsignal.io/briefs/2026-07-dos-dd-trace-java/","summary":"A denial-of-service vulnerability, CVE-2026-50270, exists in Datadog tracing libraries (dd-trace-java prior to version 1.62.0) that implement W3C baggage propagation. Remote, unauthenticated attackers can exploit this by sending HTTP requests with W3C baggage headers containing an arbitrarily large number of comma-separated key-value pairs. The tracer, when extracting these headers, fails to enforce item-count or byte-size limits, leading to unbounded CPU and memory consumption as it allocates hash-map entries for each pair, thereby causing a denial of service against the instrumented HTTP service.","title":"Datadog dd-trace-java DoS Vulnerability via W3C Baggage Headers","url":"https://feed.craftedsignal.io/briefs/2026-07-dos-dd-trace-java/"}],"language":"en","title":"CraftedSignal Threat Feed - Datadog","version":"https://jsonfeed.org/version/1.1"}