CVE-2026-50273: Datadog .NET Tracer DoS Vulnerability

CVE-2026-50273 Overview

CVE-2026-50273 is a resource exhaustion vulnerability in the Datadog .NET Tracer client library for Datadog Application Performance Monitoring (APM). Versions prior to 3.43.0 implement W3C baggage propagation but fail to enforce the DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits during header extraction. A remote unauthenticated attacker can send a crafted baggage HTTP header containing many comma-separated key-value pairs or a single oversized value. Services with baggage propagation enabled will consume unbounded CPU and memory while parsing the header. Datadog fixed the issue in version 3.43.0.

Critical Impact
Remote unauthenticated attackers can trigger unbounded CPU and memory consumption in any .NET service running an affected Datadog tracer with baggage propagation enabled, causing denial of service.

Affected Products

Datadog .NET Tracer versions prior to 3.43.0
.NET applications using Datadog APM with W3C baggage propagation enabled
Services exposing HTTP endpoints instrumented by the affected tracer library

Discovery Timeline

2026-07-17 - CVE-2026-50273 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-50273

Vulnerability Analysis

The flaw is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. The Datadog .NET Tracer participates in distributed tracing by extracting the W3C baggage HTTP header from incoming requests. The library exposes two configuration knobs, DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES, intended to bound parsing cost. Before version 3.43.0, the extraction path in W3CBaggagePropagator.cs invoked ParseHeader without passing these limits, so both settings were ignored during inbound processing. Any downstream service instrumented with the tracer therefore parses arbitrarily large baggage payloads on every request, transforming a lightweight header into an amplification primitive against the host process.

Root Cause

The root cause is missing enforcement of configured resource limits at the parsing boundary. The ParseHeader function iterated over comma-separated key-value pairs and allocated data structures proportional to attacker-controlled input length. Because the caller did not pass the BaggageMaximumItems or BaggageMaximumBytes settings, no early termination occurred once the safe threshold was exceeded.

Attack Vector

Exploitation requires only network access to any HTTP endpoint served by an affected instrumented application. The attacker sends an HTTP request containing a baggage header packed with thousands of key=value pairs or a single very large value. Each request forces the tracer to allocate memory and consume CPU cycles during header parsing, and repeated requests exhaust process resources.

csharp

// Patch: tracer/src/Datadog.Trace/Propagators/W3CBaggagePropagator.cs
            return false;
        }

-        var baggage = ParseHeader(header!);
+        var settings = Tracer.Instance.Settings;
+        var baggage = ParseHeader(header!, settings.BaggageMaximumItems, settings.BaggageMaximumBytes);

        if (baggage is { Count: > 0 })
        {

Source: DataDog/dd-trace-dotnet commit 38092e0d. The fix retrieves the tracer settings and passes BaggageMaximumItems and BaggageMaximumBytes into ParseHeader, enforcing the intended caps during extraction.

Detection Methods for CVE-2026-50273

Indicators of Compromise

Inbound HTTP requests containing unusually large baggage headers, particularly headers exceeding a few kilobytes or containing hundreds of comma-separated entries.
Sustained high CPU or memory utilization in .NET worker processes correlated with request bursts against instrumented endpoints.
Repeated allocations and garbage collection pressure originating from Datadog.Trace.Propagators.W3CBaggagePropagator.

Detection Strategies

Inspect web server, reverse proxy, and WAF logs for the baggage request header and alert on entries beyond a reasonable size threshold, such as 8 KB.
Correlate HTTP access logs with .NET runtime metrics to identify request patterns preceding CPU or memory spikes.
Query dependency manifests and running process telemetry for Datadog.Trace versions earlier than 3.43.0.

Monitoring Recommendations

Track process-level CPU, working set, and Gen 2 garbage collection frequency for services running the Datadog .NET Tracer.
Enable request-size and header-size logging at edge proxies to establish a baseline and flag outliers.
Alert on repeated requests from a single source containing oversized baggage headers targeting instrumented endpoints.

How to Mitigate CVE-2026-50273

Immediate Actions Required

Upgrade the Datadog .NET Tracer to version 3.43.0 or later across all instrumented services.
Inventory all .NET applications that reference the Datadog.Trace package and verify the deployed version in production.
Restrict or drop inbound baggage headers at edge proxies until the patched tracer is deployed.

Patch Information

Datadog released the fix in version 3.43.0. Details are available in the GitHub Security Advisory GHSA-38wr-vpc7-2mp4, the dd-trace-dotnet v3.43.0 release notes, and pull request #8555. The patch enforces BaggageMaximumItems and BaggageMaximumBytes during header extraction.

Workarounds

Disable W3C baggage propagation on the tracer where it is not required by downstream consumers.
Configure the edge proxy or WAF to strip or size-limit the baggage header on inbound requests.
Apply per-client rate limits on endpoints instrumented by the affected tracer to reduce amplification impact.

bash

# Example NGINX configuration to cap or remove the baggage header
http {
    # Drop oversized baggage headers before they reach the .NET application
    map $http_baggage $sanitized_baggage {
        default        $http_baggage;
        "~^.{8192,}$"  "";
    }

    server {
        location / {
            proxy_set_header baggage $sanitized_baggage;
            proxy_pass http://dotnet_upstream;
        }
    }
}