Unbounded W3C tracestate parsing may lead to DoS
High7.5CVE-2026-54788 · Published Jun 22, 2026
### Impact Datadog tracing libraries that implement W3C Trace Context (`tracecontext`) propagation parse the incoming `tracestate` header without enforcing a size cap on the Datadog vendor entry (`dd=...`). The `dd=` value contains semicolon-separated `key:value` pairs, and the parser allocates a hash-map entry for each pair. A remote, unauthenticated attacker can send a `tracestate` header whose `dd=` member is arbitrarily large (or contains an arbitrarily large number of pairs), forcing unbounded CPU and memory consumption per request and enabling a remote Denial of Service.`tracecontext` extraction is enabled by default in affected tracers, so any internet-facing service instrumented with an affected version is exposed unless `tracecontext` has been explicitly removed from the propagation style configuration. ### Patches This is resolved in version 0.3.3 and later of the `dd-trace-rs` library. ### Workarounds If you cannot upgrade immediately: 1. Disable `tracecontext` extraction by setting `DD_TRACE_PROPAGATION_STYLE_EXTRACT` to a value that does not include `tracecontext` (for example, `datadog`). 2. Cap the maximum HTTP request header size at an upstream proxy or web server...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| datadog-opentelemetry crates.io | >= 0.1.0, < 0.3.3 | 0.3.3 |
Details and references
### Impact Datadog tracing libraries that implement W3C Trace Context (`tracecontext`) propagation parse the incoming `tracestate` header without enforcing a size cap on the Datadog vendor entry (`dd=...`). The `dd=` value contains semicolon-separated `key:value` pairs, and the parser allocates a hash-map entry for each pair. A remote, unauthenticated attacker can send a `tracestate` header whose `dd=` member is arbitrarily large (or contains an arbitrarily large number of pairs), forcing unbounded CPU and memory consumption per request and enabling a remote Denial of Service.`tracecontext` extraction is enabled by default in affected tracers, so any internet-facing service instrumented with an affected version is exposed unless `tracecontext` has been explicitly removed from the propagation style configuration. ### Patches This is resolved in version 0.3.3 and later of the `dd-trace-rs` library. ### Workarounds If you cannot upgrade immediately: 1. Disable `tracecontext` extraction by setting `DD_TRACE_PROPAGATION_STYLE_EXTRACT` to a value that does not include `tracecontext` (for example, `datadog`). 2. Cap the maximum HTTP request header size at an upstream proxy or web server. ### References W3C Trace Context specification, `tracestate` field: - https://www.w3.org/TR/trace-context/#tracestate-header-field-values - https://www.w3.org/TR/trace-context/#tracestate-limits
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
More Datadog advisories
All Datadog| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 7 | Datadog SSI Injector can be used to trigger a Local Privilege Escalation in certain conditions | High7.4 | 0.66.0 |
| Jun 9 | Improper parsing of W3C baggage headers may lead to DoS | High7.5 | 2.1.0 |
| Jun 5 | Improper parsing of W3C baggage headers may lead to DoS | High7.5 | 2.32.0 |
| Jun 5 | Improper parsing of W3C baggage headers may lead to DoS | High7.5 | 2.8.1+1 more |
| Jun 5 | Improper parsing of W3C baggage headers may lead to DoS | High7.5 | 5.100.0 |
| Jun 5 | Improper parsing of W3C baggage headers may lead to DoS | High7.5 | 3.43.0+1 more |