CVE-2026-54788: Datadog dd-trace-rs DoS Vulnerability

CVE-2026-54788 Overview

CVE-2026-54788 is a denial of service vulnerability in dd-trace-rs, the Datadog application performance monitoring library for Rust. The flaw resides in datadog-opentelemetry/src/propagation/tracecontext.rs, which parses the W3C tracestate header and collects every semicolon-separated key-value pair from the Datadog dd=... vendor entry into a HashMap without enforcing pair count or entry size limits. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an oversized dd=... entry to force excessive CPU and memory consumption on every request. Versions from 0.1.0 through 0.3.2 are affected, and the issue is fixed in 0.3.3.

Critical Impact
Remote unauthenticated attackers can trigger sustained CPU and memory exhaustion in any Rust network service instrumented with dd-trace-rs, causing denial of service without authentication or user interaction.

Affected Products

dd-trace-rs (datadog-opentelemetry crate) versions 0.1.0 through 0.3.2
Rust network services using Datadog OpenTelemetry propagation with default configuration
Any HTTP-facing workload that accepts and parses W3C tracestate headers via dd-trace-rs

Discovery Timeline

2026-08-28 - CVE-2026-54788 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-54788

Vulnerability Analysis

The vulnerability is an uncontrolled resource consumption issue [CWE-770] in the W3C Trace Context propagation logic. The parser in tracecontext.rs iterates over semicolon-separated pairs in the Datadog vendor section (dd=...) of the tracestate header and inserts each pair into a HashMap. No upper bound is enforced on the number of pairs, the size of individual keys or values, or the cumulative memory footprint.

Because propagation extraction runs for every inbound request when tracecontext is enabled, the parsing cost scales linearly with attacker-controlled input. An attacker can craft a single request containing a very large dd=... entry to force the service to allocate and hash a large number of entries per request. Repeating this pattern across concurrent connections drives CPU and memory usage high enough to degrade or halt the service.

Root Cause

The root cause is the absence of input validation and size caps in the tracestate parser. The code trusts remote-supplied header content and stores parsed pairs in an unbounded map. There is no maximum pair count, no per-value length limit, and no early-termination guard on oversized inputs.

Attack Vector

Exploitation requires only network access to a service instrumented with a vulnerable dd-trace-rs version. The attacker sends HTTP requests containing an oversized tracestate header with a large dd= vendor entry. No authentication, credentials, or user interaction are required. Refer to the GitHub Security Advisory GHSA-gpwf-4h98-v82q and the fix commit for parser-level technical details.

Detection Methods for CVE-2026-54788

Indicators of Compromise

Inbound HTTP requests containing unusually large tracestate headers, particularly with oversized dd=... vendor sections.
Sudden spikes in CPU and heap memory usage in Rust services correlated with request arrival rather than business logic execution.
Elevated request latency or worker thread starvation in services running dd-trace-rs versions prior to 0.3.3.

Detection Strategies

Inspect W3C tracestate headers at the reverse proxy or application gateway and flag entries exceeding standard size expectations (RFC 9110 recommends conservative header sizing).
Correlate application performance metrics (CPU, RSS, GC pressure) with request-level telemetry to identify header-driven resource spikes.
Query dependency inventories for dd-trace-rs and datadog-opentelemetry versions below 0.3.3.

Monitoring Recommendations

Alert on per-request CPU time or allocation counts that exceed baseline in instrumented Rust services.
Log rejected or truncated tracestate headers at ingress for post-incident analysis.
Track upstream advisories on the dd-trace-rs GitHub repository for follow-on fixes.

How to Mitigate CVE-2026-54788

Immediate Actions Required

Upgrade dd-trace-rs (datadog-opentelemetry crate) to version 0.3.3 or later and redeploy affected services.
Enforce maximum header size limits at load balancers, reverse proxies, and web frameworks in front of Rust services.
Audit all Rust services for direct or transitive dependencies on vulnerable versions using cargo tree and cargo audit.

Patch Information

The fix is available in datadog-opentelemetry v0.3.3. See the GitHub Release v0.3.3, the merged Pull Request #218, and the fix commit 77c5d185 for implementation details. The patch adds bounded parsing of the dd= vendor entry in tracecontext.rs.

Workarounds

Strip or rewrite the tracestate header at an upstream proxy for requests originating from untrusted networks until the upgrade is deployed.
Disable W3C tracecontext extraction in dd-trace-rs configuration where trace propagation from external clients is not required.
Apply strict maximum header size and request size limits at ingress (for example, Nginx large_client_header_buffers and application-level guards).

bash

# Configuration example
# Upgrade the vulnerable crate
cargo update -p datadog-opentelemetry --precise 0.3.3

# Verify installed version
cargo tree -i datadog-opentelemetry

# Nginx ingress: cap header size to blunt oversized tracestate payloads
# http { large_client_header_buffers 4 8k; client_header_buffer_size 1k; }