GHSA-38wr-vpc7-2mp4Published

Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS

cve-program · CVE-2026-50273

Published

dd-trace-dotnet

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "DataDog",
                    "product": "dd-trace-dotnet",
                    "versions": [
                        {
                            "version": "< 3.43.0",
                            "status": "affected"
                        }
                    ]
                }

nvd · CVE-2026-50273

Published

No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.

osv · GHSA-38wr-vpc7-2mp4

Published

Datadog.Trace

NuGet

ECOSYSTEM · introduced 0 → fixed 3.43.0

230 explicitly affected versions

0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.2.3-alpha, 0.2.4-alpha, 0.3.0-beta, 0.3.1-beta, 0.3.2-beta, 0.4.0-beta, 0.4.1-beta, 0.5.0, 0.5.0-beta, 0.5.1-beta, 0.5.2-beta, 0.6.0-beta, 0.7.0-beta, 0.7.1-beta, 0.8.0-beta, 0.8.1-beta, 0.8.2-beta, 1.0.0, 1.1.0, 1.10.0, 1.10.1-prerelease, 1.10.2-prerelease, 1.10.3-prerelease, 1.11.0, 1.11.1-prerelease, 1.12.0, 1.13.0, 1.13.2, 1.13.3-prerelease, 1.13.4-prerelease, 1.14.0, 1.14.1-prerelease, 1.14.2, 1.15.0, 1.15.1-prerelease, 1.16.0, 1.16.1, 1.16.2, 1.16.3-prerelease, 1.17.0, 1.17.1-prerelease, 1.18.0, 1.18.1-prerelease, 1.18.2, 1.18.3, 1.19.0, 1.19.1, 1.19.2, 1.19.3, 1.19.4, 1.19.5, 1.19.6-prerelease, 1.2.0, 1.20.0, 1.21.0, 1.21.1, 1.21.2-prerelease, 1.22.0, 1.22.1-prerelease, 1.22.2-prerelease, 1.23.0, 1.24.0, 1.25.0, 1.25.2-prerelease, 1.26.0, 1.26.1, 1.26.2, 1.26.3, 1.27.0, 1.27.1, 1.28.0, 1.28.1-prerelease, 1.28.2, 1.28.3-prerelease, 1.28.4, 1.28.5-prerelease, 1.28.6, 1.28.7, 1.28.8, 1.29.0, 1.29.1-prerelease, 1.30.0, 1.30.1, 1.31.0, 1.31.1, 1.31.2, 1.4.0, 1.4.1, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.8.0, 1.9.0, 1.9.1-prerelease, 2.0.0-prerelease, 2.0.1, 2.1.0, 2.1.1, 2.10.0, 2.11.0, 2.12.0, 2.13.0, 2.14.0, 2.15.0, 2.16.0, 2.17.0, 2.18.0, 2.19.0, 2.2.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, 2.24.1, 2.25.0, 2.26.0, 2.27.0, 2.28.0, 2.29.0, 2.3.0, 2.30.0, 2.31.0, 2.32.0, 2.33.0, 2.34.0, 2.35.0, 2.36.0, 2.37.0, 2.38.0, 2.39.0, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.40.0, 2.41.0, 2.42.0, 2.43.0, 2.44.0, 2.45.0, 2.46.0, 2.47.0, 2.48.0, 2.49.0, 2.5.0, 2.5.1, 2.50.0, 2.51.0, 2.52.0, 2.53.0, 2.53.1, 2.53.2, 2.54.0, 2.55.0, 2.56.0, 2.57.0, 2.58.0, 2.59.0, 2.6.0, 2.60.0, 2.61.0, 2.7.0, 2.8.0, 2.9.0, 3.0.0-prerelease, 3.1.0-prerelease, 3.10.0, 3.10.1, 3.10.2, 3.11.0, 3.11.1, 3.12.0, 3.13.0, 3.14.0, 3.14.1, 3.14.2, 3.14.3, 3.15.0, 3.16.0, 3.17.0, 3.18.0, 3.19.0, 3.2.0, 3.20.0, 3.20.1, 3.21.0, 3.22.0, 3.23.0, 3.24.0, 3.24.1, 3.25.0, 3.26.0, 3.26.1, 3.26.2, 3.26.3, 3.27.0, 3.28.0, 3.29.0, 3.3.0, 3.3.1, 3.30.0, 3.31.0, 3.32.0, 3.32.1, 3.33.0, 3.34.0, 3.35.0, 3.36.0, 3.37.0, 3.38.0, 3.39.0, 3.4.0, 3.4.1, 3.40.0, 3.41.0, 3.42.0, 3.5.0, 3.6.0, 3.6.1, 3.7.0, 3.8.0, 3.9.0, 3.9.1

Datadog.Trace.OpenTracing

NuGet

ECOSYSTEM · introduced 0 → fixed 3.43.0

221 explicitly affected versions

0.2.3-alpha, 0.2.4-alpha, 0.3.0-beta, 0.3.1-beta, 0.3.2-beta, 0.4.0-beta, 0.4.1-beta, 0.5.0, 0.5.0-beta, 0.5.1-beta, 0.5.2-beta, 0.6.0-beta, 0.7.0-beta, 0.7.1-beta, 0.8.0-beta, 0.8.1-beta, 0.8.2-beta, 1.0.0, 1.10.0, 1.10.1-prerelease, 1.10.3-prerelease, 1.11.0, 1.11.1-prerelease, 1.12.0, 1.13.0, 1.13.4-prerelease, 1.14.0, 1.14.2, 1.15.0, 1.15.1-prerelease, 1.16.0, 1.16.1, 1.16.2, 1.16.3-prerelease, 1.17.0, 1.17.1-prerelease, 1.18.0, 1.18.1-prerelease, 1.18.2, 1.18.3, 1.19.0, 1.19.1, 1.19.2, 1.19.3, 1.19.4, 1.19.5, 1.19.6-prerelease, 1.2.0, 1.20.0, 1.21.0, 1.21.1, 1.21.2-prerelease, 1.22.0, 1.22.1-prerelease, 1.22.2-prerelease, 1.23.0, 1.24.0, 1.25.0, 1.25.2-prerelease, 1.26.0, 1.26.1, 1.26.2, 1.26.3, 1.27.0, 1.27.1, 1.28.0, 1.28.1-prerelease, 1.28.2, 1.28.3-prerelease, 1.28.4, 1.28.5-prerelease, 1.28.6, 1.28.7, 1.28.8, 1.29.0, 1.29.1-prerelease, 1.30.0, 1.30.1, 1.31.0, 1.31.1, 1.31.2, 1.4.0, 1.4.1, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.8.0, 1.9.0, 1.9.1-prerelease, 2.0.0-prerelease, 2.0.1, 2.1.0, 2.1.1, 2.10.0, 2.11.0, 2.12.0, 2.13.0, 2.14.0, 2.15.0, 2.16.0, 2.17.0, 2.18.0, 2.19.0, 2.2.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, 2.24.1, 2.25.0, 2.26.0, 2.27.0, 2.28.0, 2.29.0, 2.3.0, 2.30.0, 2.31.0, 2.32.0, 2.33.0, 2.34.0, 2.35.0, 2.36.0, 2.37.0, 2.38.0, 2.39.0, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.40.0, 2.41.0, 2.42.0, 2.43.0, 2.44.0, 2.45.0, 2.46.0, 2.47.0, 2.48.0, 2.49.0, 2.5.0, 2.5.1, 2.50.0, 2.51.0, 2.52.0, 2.53.0, 2.53.1, 2.53.2, 2.54.0, 2.55.0, 2.56.0, 2.57.0, 2.58.0, 2.59.0, 2.6.0, 2.60.0, 2.61.0, 2.7.0, 2.8.0, 2.9.0, 3.0.0-prerelease, 3.1.0-prerelease, 3.10.0, 3.10.1, 3.10.2, 3.11.0, 3.11.1, 3.12.0, 3.13.0, 3.14.0, 3.14.1, 3.14.2, 3.14.3, 3.15.0, 3.16.0, 3.17.0, 3.18.0, 3.19.0, 3.2.0, 3.20.0, 3.20.1, 3.21.0, 3.22.0, 3.23.0, 3.24.0, 3.24.1, 3.25.0, 3.26.0, 3.26.1, 3.26.2, 3.26.3, 3.27.0, 3.28.0, 3.29.0, 3.3.0, 3.3.1, 3.30.0, 3.31.0, 3.32.0, 3.32.1, 3.33.0, 3.34.0, 3.35.0, 3.36.0, 3.37.0, 3.38.0, 3.39.0, 3.4.0, 3.4.1, 3.40.0, 3.41.0, 3.42.0, 3.5.0, 3.6.0, 3.6.1, 3.7.0, 3.8.0, 3.9.0, 3.9.1