{"id":"CVE-2026-50273","sourceIdentifier":"security-advisories@github.com","published":"2026-07-17T18:17:16.840","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0."},{"lang":"es","value":"Datadog .NET Tracer es una biblioteca cliente para Datadog APM para aplicaciones .NET. Antes de la versión 3.43.0, las bibliotecas de rastreo de Datadog que implementan la propagación de equipaje W3C analizan los encabezados HTTP de equipaje entrantes sin aplicar DD_TRACE_BAGGAGE_MAX_ITEMS o DD_TRACE_BAGGAGE_MAX_BYTES en la extracción, permitiendo a un atacante remoto no autenticado enviar un encabezado de equipaje con muchos pares clave-valor separados por comas o un valor muy grande y causar un consumo ilimitado de CPU y memoria en servicios con la propagación de equipaje habilitada. Este problema está solucionado en la versión 3.43.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"DataDog","product":"dd-trace-dotnet","versions":[{"version":"< 3.43.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-17T19:46:28.497491Z","id":"CVE-2026-50273","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/DataDog/dd-trace-dotnet/commit/38092e0d41a36decbe649e048e48ae1b1607292f","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-dotnet/pull/8555","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-dotnet/releases/tag/v3.43.0","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-dotnet/security/advisories/GHSA-38wr-vpc7-2mp4","source":"security-advisories@github.com"}]}