CVE-2026-50271: Datadog dd-trace-py DoS Vulnerability

CVE-2026-50271 Overview

CVE-2026-50271 is a denial-of-service vulnerability in Datadog dd-trace-py, the Datadog Python Application Performance Monitoring (APM) client. Versions prior to 4.8.2 fail to enforce the DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path when parsing W3C baggage propagation headers. A remote, unauthenticated attacker can submit an HTTP request containing a baggage header with an arbitrarily large number of comma-separated key-value pairs or a single oversized value. The resulting parsing consumes unbounded CPU and memory, degrading or halting HTTP services that have baggage propagation enabled. The issue is categorized as an allocation of resources without limits weakness [CWE-770].

Critical Impact
Remote unauthenticated attackers can exhaust CPU and memory on any HTTP service instrumented with vulnerable dd-trace-py versions and baggage propagation enabled, causing service-wide denial of service.

Affected Products

Datadog dd-trace-py versions prior to 4.8.2
Python HTTP services using dd-trace-py with W3C baggage propagation enabled
Applications relying on Datadog APM tracing libraries implementing baggage extraction

Discovery Timeline

2026-07-17 - CVE-2026-50271 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-50271

Vulnerability Analysis

The vulnerability resides in the HTTP propagation logic in ddtrace/propagation/http.py. The tracing library extracts the incoming baggage HTTP header and parses its comma-separated key-value pairs to reconstruct the propagated context. Although the library exposes DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES configuration knobs to bound baggage size, the extract path did not honor these limits. As a result, parsing scaled linearly with attacker-controlled input, and no upper bound protected the process.

Because baggage extraction runs before application logic on every inbound request, an attacker only needs network reachability to the HTTP endpoint. No authentication, session, or user interaction is required. The impact is limited to availability — integrity and confidentiality are not affected.

Root Cause

The root cause is missing enforcement of resource limits during header parsing [CWE-770]. Configuration-defined caps on baggage item count and byte length existed for the inject path but were absent from the extract path, allowing unbounded work per request.

Attack Vector

The attack is fully network-based. An attacker sends a single HTTP request containing a crafted baggage header — either thousands of comma-separated key=value entries or one entry with an oversized value. The Python worker process handling the request performs string splitting, decoding, and dictionary construction proportional to the payload size, spiking CPU and memory until the worker is exhausted or killed by the runtime.

python

_HTTP_HEADER_TRACEPARENT: Literal["traceparent"] = "traceparent"
_HTTP_HEADER_TRACESTATE: Literal["tracestate"] = "tracestate"
_HTTP_HEADER_BAGGAGE: Literal["baggage"] = "baggage"
BAGGAGE_DELIMITER = ","


def _possible_header(header: str) -> frozenset[str]:
    ...

Source: GitHub Commit 9c80faa — the patch introduces the BAGGAGE_DELIMITER constant and adds bounded extraction logic that enforces the configured item count and byte-size limits during header parsing.

Detection Methods for CVE-2026-50271

Indicators of Compromise

Inbound HTTP requests carrying unusually large baggage headers, particularly those exceeding several kilobytes or containing hundreds of comma-separated pairs
Sudden spikes in CPU utilization or resident memory on Python worker processes correlating with specific request IDs
HTTP 5xx responses, worker timeouts, or process kills logged by WSGI/ASGI servers under low overall request volume

Detection Strategies

Enable HTTP request logging at the reverse proxy or ingress layer and alert on baggage header length exceeding a defined threshold (for example, 8 KB).
Correlate application performance metrics for the tracing hot path with request-level headers to identify outlier requests driving allocation spikes.
Query package inventory for Python services running dd-trace-py versions below 4.8.2 and flag those exposing HTTP endpoints externally.

Monitoring Recommendations

Track memory and CPU per Python worker and alert on rapid saturation without corresponding request volume increases.
Monitor the count and total byte length of the baggage header on inbound traffic and baseline typical values for your services.
Review APM error rates for MemoryError, worker restart events, or gunicorn/uvicorn timeout signals following exposure to untrusted networks.

How to Mitigate CVE-2026-50271

Immediate Actions Required

Upgrade dd-trace-py to version 4.8.2 or later on all Python services that process HTTP traffic.
Inventory production Python workloads and identify those with baggage propagation enabled while awaiting patch rollout.
Deploy a WAF or reverse-proxy rule that rejects or truncates requests whose baggage header exceeds a safe upper bound.

Patch Information

The fix is available in dd-trace-py version 4.8.2, released as GitHub Release v4.8.2. The pull request implementing the fix is tracked as PR #17926 and the security advisory is published as GHSA-mw54-j2v2-42hr. The patch enforces DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES on the extract path.

Workarounds

Disable W3C baggage propagation on affected services if the feature is not required by the tracing topology.
Strip or size-limit the baggage header at the load balancer, API gateway, or ingress controller before it reaches Python workers.
Apply per-request body and header size limits at the WSGI/ASGI server layer to bound worst-case parsing cost.

bash

# Upgrade dd-trace-py to the fixed release
pip install --upgrade 'ddtrace>=4.8.2'

# Example NGINX rule to cap baggage header size before it reaches the app
# In the server or location block:
#   large_client_header_buffers 4 8k;
#   if ($http_baggage ~* ".{4096,}") { return 431; }