{"id":"CVE-2026-50274","sourceIdentifier":"security-advisories@github.com","published":"2026-07-17T21:17:07.337","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1."},{"lang":"es","value":"Datadog dd-trace-go es una biblioteca cliente Go para la monitorización del rendimiento de aplicaciones, la elaboración de perfiles y la monitorización de seguridad de Datadog. Antes de la versión 2.8.1, las bibliotecas de rastreo de Datadog que implementan la propagación de equipaje W3C analizan los encabezados HTTP de equipaje entrantes sin aplicar los límites DD_TRACE_BAGGAGE_MAX_ITEMS o DD_TRACE_BAGGAGE_MAX_BYTES en la ruta de extracción. Un atacante remoto no autenticado puede enviar una solicitud cuyo encabezado de equipaje contiene un número arbitrariamente grande de pares clave-valor separados por comas o un único valor muy grande, causando un consumo ilimitado de CPU y memoria y permitiendo una denegación de servicio remota contra servicios HTTP con la propagación de equipaje habilitada. Este problema está solucionado en la versión 2.8.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"DataDog","product":"dd-trace-go","versions":[{"version":"< 2.8.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-20T15:02:21.456415Z","id":"CVE-2026-50274","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-go/pull/4720","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8","source":"security-advisories@github.com"}]}