GO-2026-6000Published
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-50274 · Microsoft / collected KEV context
cve-program · CVE-2026-50274
- https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8
- https://github.com/DataDog/dd-trace-go/pull/4720
- https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df
- https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1
nvd · CVE-2026-50274
- https://github.com/DataDog/dd-trace-go/commit/192712ba0291b2e89166259111ebb5e90c8f52df
- https://github.com/DataDog/dd-trace-go/pull/4720
- https://github.com/DataDog/dd-trace-go/releases/tag/v2.8.1
- https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8
osv · GHSA-74j5-xf3v-crq8
- https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-74j5-xf3v-crq8
- https://github.com/DataDog/dd-trace-go
osv · GO-2026-6000
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.