{"id":"CVE-2026-50271","aliases":["EUVD-2026-45329","GHSA-mw54-j2v2-42hr","PYSEC-2026-3461","ROOT-APP-PYPI-CVE-2026-50271"],"status":"published","title":"dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS","description":"Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00793,"percentile":0.56618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-07-15T22:55:24Z","modified":"2026-11-03T12:15:08Z","fixes":[{"ecosystem":"PyPI","package":"ddtrace","fixed_in":["4.8.2"],"sources":["ghsa","osv"]},{"ecosystem":"Root:PyPI","package":"ddtrace","fixed_in":["3.2.0+aikido.2","2.1.3+aikido.1","4.7.1+aikido.1","4.8.0+aikido.1","1.7.3+aikido.1","3.19.5+aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"ddtrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ddtrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.2"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.21.1","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.27.1","0.28.0","0.29.0","0.30.0","0.30.1","0.30.2","0.31.0","0.32.0","0.32.1","0.32.2","0.33.0","0.34.0","0.34.1","0.34.2","0.35.0","0.35.1","0.35.2","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.37.3","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.39.0","0.39.1","0.39.2","0.40.0","0.40.1","0.40.2","0.41.0","0.41.1","0.41.2","0.42.0","0.43.0","0.43.1","0.44.0","0.45.0","0.46.0","0.47.0","0.48.0","0.48.1","0.48.2","0.48.3","0.48.4","0.49.0","0.49.0rc1","0.49.0rc2","0.49.1","0.49.2","0.49.3","0.49.4","0.5.3","0.5.4","0.5.5","0.50.0","0.50.0rc1","0.50.0rc2","0.50.0rc3","0.50.0rc4","0.50.0rc5","0.50.0rc6","0.50.0rc7","0.50.1","0.50.2","0.50.3","0.50.4","0.51.0","0.51.0rc1","0.51.0rc2","0.51.0rc3","0.51.0rc4","0.51.1","0.51.2","0.51.3","0.52.0","0.52.0rc1","0.52.0rc3","0.52.1","0.52.2","0.53.0","0.53.0rc1","0.53.0rc2","0.53.1","0.53.2","0.53.3","0.54.0","0.54.0rc1","0.54.1","0.55.0","0.55.0rc1","0.55.0rc2","0.55.1","0.55.2","0.55.3","0.55.4","0.56.0","0.56.0rc1","0.56.0rc2","0.56.0rc3","0.56.0rc4","0.56.0rc5","0.56.0rc6","0.56.0rc7","0.56.1","0.57.0","0.57.0rc1","0.57.0rc2","0.57.0rc3","0.57.1","0.57.2","0.57.3","0.57.4","0.58.0","0.58.0rc1","0.58.1","0.58.2","0.58.3","0.58.4","0.58.5","0.59.0","0.59.0rc1","0.59.0rc2","0.59.0rc3","0.59.1","0.59.2","0.6.0","0.60.0","0.60.0rc1","0.60.0rc2","0.60.0rc3","0.60.0rc4","0.60.0rc5","0.60.1","0.60.2","0.60.3","0.60.4","0.60.5","0.60.6","0.61.0","0.61.0rc1","0.61.0rc2","0.61.1","0.61.2","0.61.3","0.61.4","0.61.5","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.9.0","0.9.1","0.9.2","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.0.1","1.0.2","1.0.3","1.1.0","1.1.0rc1","1.1.0rc2","1.1.0rc3","1.1.1","1.1.2","1.1.3","1.1.4","1.10.0","1.10.0rc1","1.10.0rc2","1.10.0rc3","1.10.1","1.10.2","1.10.3","1.11.0","1.11.0rc1","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.12.0","1.12.0rc1","1.12.1","1.12.10","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9","1.13.0","1.13.0rc1","1.13.0rc2","1.13.0rc3","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.14.0","1.14.0rc1","1.14.0rc2","1.14.1","1.14.2","1.14.3","1.15.0","1.15.0rc1","1.15.1","1.15.2","1.16.0","1.16.0rc1","1.16.0rc2","1.16.1","1.16.2","1.16.3","1.16.4","1.17.0","1.17.0rc1","1.17.1","1.17.2","1.17.3","1.17.4","1.17.5","1.17.6","1.18.0","1.18.0rc1","1.18.1","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.19.0","1.19.0rc1","1.19.1","1.19.2","1.19.3","1.19.4","1.19.5","1.19.6","1.19.7","1.2.0","1.2.0rc1","1.2.0rc2","1.2.0rc3","1.2.1","1.2.1rc1","1.2.2","1.2.3","1.20.0","1.20.0rc1","1.20.1","1.20.10","1.20.11","1.20.12","1.20.13","1.20.14","1.20.15","1.20.16","1.20.17","1.20.18","1.20.19","1.20.2","1.20.3","1.20.4","1.20.5","1.20.6","1.20.7","1.20.8","1.20.9","1.3.0","1.3.0rc1","1.3.0rc2","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.4.0","1.4.0rc1","1.4.0rc2","1.4.0rc3","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.0rc1","1.5.0rc2","1.5.0rc3","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0rc1","1.6.0rc2","1.6.0rc3","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.7.0","1.7.0rc1","1.7.0rc2","1.7.0rc3","1.7.0rc4","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.8.0","1.8.0rc1","1.8.0rc2","1.8.0rc3","1.8.0rc4","1.8.1","1.8.2","1.8.3","1.9.0","1.9.0rc2","1.9.0rc3","1.9.0rc4","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","2.0.0","2.0.0rc2","2.0.1","2.0.10","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0rc1","2.1.0rc2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.10.0","2.10.0rc1","2.10.0rc2","2.10.0rc3","2.10.0rc4","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.11.0","2.11.0rc1","2.11.0rc2","2.11.1","2.11.2","2.11.3","2.11.4","2.11.5","2.11.6","2.11.7","2.11.8","2.12.0","2.12.0rc1","2.12.0rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.0rc1","2.13.1","2.13.2","2.13.3","2.14.0","2.14.0rc1","2.14.1","2.14.2","2.14.4","2.14.5","2.14.6","2.14.7","2.15.0","2.15.0rc1","2.15.0rc2","2.15.0rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0rc1","2.16.0rc2","2.16.1","2.16.2","2.16.3","2.16.4","2.16.5","2.16.6","2.17.0","2.17.0rc1","2.17.0rc2","2.17.1","2.17.2","2.17.3","2.17.4","2.17.5","2.18.0","2.18.0rc1","2.18.1","2.18.2","2.19.0","2.19.0rc1","2.19.0rc2","2.19.1","2.19.2","2.19.3","2.19.4","2.2.0","2.2.0rc1","2.2.1","2.2.2","2.2.3","2.20.0","2.20.0rc1","2.20.1","2.20.2","2.21.0","2.21.0rc1","2.21.1","2.21.10","2.21.11","2.21.12","2.21.2","2.21.3","2.21.4","2.21.5","2.21.5rc1","2.21.6","2.21.7","2.21.8","2.21.9","2.3.0","2.3.0rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0rc1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.0rc1","2.5.0rc2","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.0rc1","2.7.1","2.7.10","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.0","2.8.0rc1","2.8.0rc2","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.9.0","2.9.0rc1","2.9.0rc2","2.9.0rc3","2.9.0rc4","2.9.0rc5","2.9.0rc6","2.9.0rc7","2.9.0rc8","2.9.0rc9","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","3.0.0","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.1.0","3.1.0rc1","3.1.1","3.10.0","3.10.0rc1","3.10.0rc2","3.10.0rc3","3.10.1","3.10.2","3.10.3","3.10.4","3.11.0","3.11.0rc1","3.11.0rc2","3.11.0rc3","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.0rc1","3.12.0rc2","3.12.0rc3","3.12.1","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6","3.12.7","3.12.8","3.12.9","3.13.0","3.13.0rc1","3.13.1","3.13.2","3.13.3","3.13.4","3.14.0","3.14.0rc1","3.14.0rc2","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0rc1","3.15.1","3.16.0","3.16.0rc1","3.16.0rc2","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0rc1","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0rc1","3.18.0rc2","3.18.1","3.19.0","3.19.0rc1","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5","3.19.6","3.19.7","3.19.8","3.2.0","3.2.0rc1","3.2.1","3.2.1rc1","3.2.1rc2","3.2.2","3.2.3","3.3.0","3.3.0rc3","3.3.1","3.3.2","3.3.3","3.4.0","3.4.0rc1","3.4.0rc2","3.4.1","3.4.2","3.5.0","3.5.0rc1","3.5.1","3.6.0","3.6.0rc1","3.7.0","3.7.0rc1","3.7.0rc2","3.7.1","3.7.2","3.8.0","3.8.0rc1","3.8.0rc2","3.8.0rc3","3.8.1","3.9.0","3.9.0rc1","3.9.0rc2","3.9.1","3.9.2","3.9.3","3.9.4","4.0.0","4.0.0rc1","4.0.0rc2","4.0.0rc3","4.0.1","4.0.2","4.0.3","4.0.4","4.1.0","4.1.0rc2","4.1.0rc3","4.1.1","4.1.2","4.1.3","4.1.4","4.2.0","4.2.0rc1","4.2.0rc2","4.2.0rc3","4.2.1","4.2.2","4.2.3","4.3.0","4.3.0rc1","4.3.1","4.3.2","4.4.0","4.4.0rc1","4.4.0rc2","4.4.0rc3","4.5.0","4.5.0rc1","4.5.0rc2","4.5.0rc3","4.5.0rc4","4.5.1","4.5.10","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.5.8","4.5.9","4.6.0","4.6.0rc1","4.6.0rc2","4.6.0rc3","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.6.6","4.6.7","4.6.8","4.7.0","4.7.0rc1","4.7.0rc2","4.7.0rc3","4.7.0rc4","4.7.0rc5","4.7.1","4.7.2","4.8.0","4.8.0rc1","4.8.0rc2","4.8.0rc3","4.8.0rc4","4.8.0rc5","4.8.1"]},{"source":"osv","ecosystem":"PyPI","package":"ddtrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.2"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.21.1","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.27.1","0.28.0","0.29.0","0.30.0","0.30.1","0.30.2","0.31.0","0.32.0","0.32.1","0.32.2","0.33.0","0.34.0","0.34.1","0.34.2","0.35.0","0.35.1","0.35.2","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.37.3","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.39.0","0.39.1","0.39.2","0.40.0","0.40.1","0.40.2","0.41.0","0.41.1","0.41.2","0.42.0","0.43.0","0.43.1","0.44.0","0.45.0","0.46.0","0.47.0","0.48.0","0.48.1","0.48.2","0.48.3","0.48.4","0.49.0","0.49.0rc1","0.49.0rc2","0.49.1","0.49.2","0.49.3","0.49.4","0.5.3","0.5.4","0.5.5","0.50.0","0.50.0rc1","0.50.0rc2","0.50.0rc3","0.50.0rc4","0.50.0rc5","0.50.0rc6","0.50.0rc7","0.50.1","0.50.2","0.50.3","0.50.4","0.51.0","0.51.0rc1","0.51.0rc2","0.51.0rc3","0.51.0rc4","0.51.1","0.51.2","0.51.3","0.52.0","0.52.0rc1","0.52.0rc3","0.52.1","0.52.2","0.53.0","0.53.0rc1","0.53.0rc2","0.53.1","0.53.2","0.53.3","0.54.0","0.54.0rc1","0.54.1","0.55.0","0.55.0rc1","0.55.0rc2","0.55.1","0.55.2","0.55.3","0.55.4","0.56.0","0.56.0rc1","0.56.0rc2","0.56.0rc3","0.56.0rc4","0.56.0rc5","0.56.0rc6","0.56.0rc7","0.56.1","0.57.0","0.57.0rc1","0.57.0rc2","0.57.0rc3","0.57.1","0.57.2","0.57.3","0.57.4","0.58.0","0.58.0rc1","0.58.1","0.58.2","0.58.3","0.58.4","0.58.5","0.59.0","0.59.0rc1","0.59.0rc2","0.59.0rc3","0.59.1","0.59.2","0.6.0","0.60.0","0.60.0rc1","0.60.0rc2","0.60.0rc3","0.60.0rc4","0.60.0rc5","0.60.1","0.60.2","0.60.3","0.60.4","0.60.5","0.60.6","0.61.0","0.61.0rc1","0.61.0rc2","0.61.1","0.61.2","0.61.3","0.61.4","0.61.5","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.9.0","0.9.1","0.9.2","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.0.1","1.0.2","1.0.3","1.1.0","1.1.0rc1","1.1.0rc2","1.1.0rc3","1.1.1","1.1.2","1.1.3","1.1.4","1.10.0","1.10.0rc1","1.10.0rc2","1.10.0rc3","1.10.1","1.10.2","1.10.3","1.11.0","1.11.0rc1","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.12.0","1.12.0rc1","1.12.1","1.12.10","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9","1.13.0","1.13.0rc1","1.13.0rc2","1.13.0rc3","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.14.0","1.14.0rc1","1.14.0rc2","1.14.1","1.14.2","1.14.3","1.15.0","1.15.0rc1","1.15.1","1.15.2","1.16.0","1.16.0rc1","1.16.0rc2","1.16.1","1.16.2","1.16.3","1.16.4","1.17.0","1.17.0rc1","1.17.1","1.17.2","1.17.3","1.17.4","1.17.5","1.17.6","1.18.0","1.18.0rc1","1.18.1","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.19.0","1.19.0rc1","1.19.1","1.19.2","1.19.3","1.19.4","1.19.5","1.19.6","1.19.7","1.2.0","1.2.0rc1","1.2.0rc2","1.2.0rc3","1.2.1","1.2.1rc1","1.2.2","1.2.3","1.20.0","1.20.0rc1","1.20.1","1.20.10","1.20.11","1.20.12","1.20.13","1.20.14","1.20.15","1.20.16","1.20.17","1.20.18","1.20.19","1.20.2","1.20.3","1.20.4","1.20.5","1.20.6","1.20.7","1.20.8","1.20.9","1.3.0","1.3.0rc1","1.3.0rc2","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.4.0","1.4.0rc1","1.4.0rc2","1.4.0rc3","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.0rc1","1.5.0rc2","1.5.0rc3","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0rc1","1.6.0rc2","1.6.0rc3","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.7.0","1.7.0rc1","1.7.0rc2","1.7.0rc3","1.7.0rc4","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.8.0","1.8.0rc1","1.8.0rc2","1.8.0rc3","1.8.0rc4","1.8.1","1.8.2","1.8.3","1.9.0","1.9.0rc2","1.9.0rc3","1.9.0rc4","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","2.0.0","2.0.0rc2","2.0.1","2.0.10","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0rc1","2.1.0rc2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.10.0","2.10.0rc1","2.10.0rc2","2.10.0rc3","2.10.0rc4","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.11.0","2.11.0rc1","2.11.0rc2","2.11.1","2.11.2","2.11.3","2.11.4","2.11.5","2.11.6","2.11.7","2.11.8","2.12.0","2.12.0rc1","2.12.0rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.0rc1","2.13.1","2.13.2","2.13.3","2.14.0","2.14.0rc1","2.14.1","2.14.2","2.14.4","2.14.5","2.14.6","2.14.7","2.15.0","2.15.0rc1","2.15.0rc2","2.15.0rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0rc1","2.16.0rc2","2.16.1","2.16.2","2.16.3","2.16.4","2.16.5","2.16.6","2.17.0","2.17.0rc1","2.17.0rc2","2.17.1","2.17.2","2.17.3","2.17.4","2.17.5","2.18.0","2.18.0rc1","2.18.1","2.18.2","2.19.0","2.19.0rc1","2.19.0rc2","2.19.1","2.19.2","2.19.3","2.19.4","2.2.0","2.2.0rc1","2.2.1","2.2.2","2.2.3","2.20.0","2.20.0rc1","2.20.1","2.20.2","2.21.0","2.21.0rc1","2.21.1","2.21.10","2.21.11","2.21.12","2.21.2","2.21.3","2.21.4","2.21.5","2.21.5rc1","2.21.6","2.21.7","2.21.8","2.21.9","2.3.0","2.3.0rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0rc1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.0rc1","2.5.0rc2","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.0rc1","2.7.1","2.7.10","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.0","2.8.0rc1","2.8.0rc2","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.9.0","2.9.0rc1","2.9.0rc2","2.9.0rc3","2.9.0rc4","2.9.0rc5","2.9.0rc6","2.9.0rc7","2.9.0rc8","2.9.0rc9","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","3.0.0","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.1.0","3.1.0rc1","3.1.1","3.10.0","3.10.0rc1","3.10.0rc2","3.10.0rc3","3.10.1","3.10.2","3.10.3","3.10.4","3.11.0","3.11.0rc1","3.11.0rc2","3.11.0rc3","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.0rc1","3.12.0rc2","3.12.0rc3","3.12.1","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6","3.12.7","3.12.8","3.12.9","3.13.0","3.13.0rc1","3.13.1","3.13.2","3.13.3","3.13.4","3.14.0","3.14.0rc1","3.14.0rc2","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0rc1","3.15.1","3.16.0","3.16.0rc1","3.16.0rc2","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0rc1","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0rc1","3.18.0rc2","3.18.1","3.19.0","3.19.0rc1","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5","3.19.6","3.19.7","3.19.8","3.2.0","3.2.0rc1","3.2.1","3.2.1rc1","3.2.1rc2","3.2.2","3.2.3","3.3.0","3.3.0rc3","3.3.1","3.3.2","3.3.3","3.4.0","3.4.0rc1","3.4.0rc2","3.4.1","3.4.2","3.5.0","3.5.0rc1","3.5.1","3.6.0","3.6.0rc1","3.7.0","3.7.0rc1","3.7.0rc2","3.7.1","3.7.2","3.8.0","3.8.0rc1","3.8.0rc2","3.8.0rc3","3.8.1","3.9.0","3.9.0rc1","3.9.0rc2","3.9.1","3.9.2","3.9.3","3.9.4","4.0.0","4.0.0rc1","4.0.0rc2","4.0.0rc3","4.0.1","4.0.2","4.0.3","4.0.4","4.1.0","4.1.0rc2","4.1.0rc3","4.1.1","4.1.2","4.1.3","4.1.4","4.2.0","4.2.0rc1","4.2.0rc2","4.2.0rc3","4.2.1","4.2.2","4.2.3","4.3.0","4.3.0rc1","4.3.1","4.3.2","4.4.0","4.4.0rc1","4.4.0rc2","4.4.0rc3","4.5.0","4.5.0rc1","4.5.0rc2","4.5.0rc3","4.5.0rc4","4.5.1","4.5.10","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.5.8","4.5.9","4.6.0","4.6.0rc1","4.6.0rc2","4.6.0rc3","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.6.6","4.6.7","4.6.8","4.7.0","4.7.0rc1","4.7.0rc2","4.7.0rc3","4.7.0rc4","4.7.0rc5","4.7.1","4.7.2","4.8.0","4.8.0rc1","4.8.0rc2","4.8.0rc3","4.8.0rc4","4.8.0rc5","4.8.1"]},{"source":"osv","ecosystem":"Root:PyPI","package":"ddtrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+aikido.2"},{"fixed":"2.1.3+aikido.1"},{"fixed":"4.7.1+aikido.1"},{"fixed":"4.8.0+aikido.1"},{"fixed":"1.7.3+aikido.1"},{"fixed":"3.19.5+aikido.1"}]}]}],"products":[{"vendor":"datadog","product":"dd-trace-py"}],"references":[{"url":"https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/DataDog/dd-trace-py/pull/17926","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/DataDog/dd-trace-py/commit/9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/DataDog/dd-trace-py/releases/tag/v4.8.2","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-mw54-j2v2-42hr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50271.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50271","tags":["advisory"]},{"url":"https://github.com/DataDog/dd-trace-py","tags":["package"]},{"url":"https://pypi.org/project/ddtrace","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-50271","title":"dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS","description":"Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.","status":"published","published":"2026-07-17T20:42:34.036Z","modified":"2026-07-20T19:16:57.759Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-45329","description":"Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.","status":"published","published":"2026-07-17T20:42:34Z","modified":"2026-07-20T19:16:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:47.959089Z"}],"ghsa":[{"id":"GHSA-mw54-j2v2-42hr","title":"dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS","description":"### Impact\nDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled.\nThe baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.\n\n### Patches\nThis is resolved in version 4.8.2 and later of the `dd-trace-py` library\n\n### Workarounds\nIf users cannot upgrade immediately:\n1. Disable `baggage` extraction by removing `baggage` from `DD_TRACE_PROPAGATION_STYLE` (or `DD_TRACE_PROPAGATION_STYLE_EXTRACT` if set independently).\n2. Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache `LimitRequestFieldSize`, Nginx `large_client_header_buffers`, Envoy `max_request_headers_kb`).\n\n\n### Resources\nRelated upstream advisories:\n[opentelemetry-go GHSA-mh2q-q3fh-2475](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475)\n[opentelemetry-dotnet GHSA-g94r-2vxg-569j](https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j)","status":"published","published":"2026-07-15T22:55:24Z","modified":"2026-07-15T22:55:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:40:44.915484Z"}],"nvd":[{"id":"CVE-2026-50271","description":"Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.","status":"published","published":"2026-07-17T21:17:07.07Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:30.631352Z"}],"osv":[{"id":"CVE-2026-50271","title":"dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS","description":"Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.","status":"published","published":"2026-07-17T20:42:34.036Z","modified":"2026-10-28T02:30:46.20397443Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"GHSA-mw54-j2v2-42hr","title":"dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS","description":"### Impact\nDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled.\nThe baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.\n\n### Patches\nThis is resolved in version 4.8.2 and later of the `dd-trace-py` library\n\n### Workarounds\nIf users cannot upgrade immediately:\n1. Disable `baggage` extraction by removing `baggage` from `DD_TRACE_PROPAGATION_STYLE` (or `DD_TRACE_PROPAGATION_STYLE_EXTRACT` if set independently).\n2. Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache `LimitRequestFieldSize`, Nginx `large_client_header_buffers`, Envoy `max_request_headers_kb`).\n\n\n### Resources\nRelated upstream advisories:\n[opentelemetry-go GHSA-mh2q-q3fh-2475](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475)\n[opentelemetry-dotnet GHSA-g94r-2vxg-569j](https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j)","status":"published","published":"2026-07-15T22:55:24Z","modified":"2026-09-10T03:50:12.62372284Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"PYSEC-2026-3461","title":"dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS","description":"### Impact\nDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled.\nThe baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.\n\n### Patches\nThis is resolved in version 4.8.2 and later of the `dd-trace-py` library\n\n### Workarounds\nIf users cannot upgrade immediately:\n1. Disable `baggage` extraction by removing `baggage` from `DD_TRACE_PROPAGATION_STYLE` (or `DD_TRACE_PROPAGATION_STYLE_EXTRACT` if set independently).\n2. Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache `LimitRequestFieldSize`, Nginx `large_client_header_buffers`, Envoy `max_request_headers_kb`).\n\n\n### Resources\nRelated upstream advisories:\n[opentelemetry-go GHSA-mh2q-q3fh-2475](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475)\n[opentelemetry-dotnet GHSA-g94r-2vxg-569j](https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j)","status":"published","published":"2026-07-23T11:41:46.329438Z","modified":"2026-07-23T15:00:11.420190209Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"ROOT-APP-PYPI-CVE-2026-50271","title":"CVE-2026-50271 in ddtrace - Patched by Root","description":"Root has patched CVE-2026-50271 in the ddtrace package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-11-03T11:43:13Z","modified":"2026-11-03T12:15:08.914578534Z","updated_at":"2026-11-03T12:31:35.467775Z"}]}}