{"id":"CVE-2026-54788","aliases":["EUVD-2026-67829","GHSA-gpwf-4h98-v82q"],"status":"published","title":"dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS","description":"dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00793,"percentile":0.56838,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-08-28T16:33:49Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"crates.io","package":"datadog-opentelemetry","fixed_in":["0.3.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"datadog-opentelemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.3.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"datadog-opentelemetry","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.3.3"}]}]}],"products":[{"vendor":"datadog","product":"dd-trace-rs"}],"references":[{"url":"https://github.com/DataDog/dd-trace-rs/security/advisories/GHSA-gpwf-4h98-v82q","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/DataDog/dd-trace-rs/pull/218","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71d0ea8103da0e6cf4cd50677ffacd2","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/DataDog/dd-trace-rs/releases/tag/datadog-opentelemetry-v0.3.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-gpwf-4h98-v82q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54788.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54788","tags":["advisory"]},{"url":"https://github.com/DataDog/dd-trace-rs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54788","title":"dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS","description":"dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.","status":"published","published":"2026-08-28T16:33:49.032Z","modified":"2026-08-31T18:57:14.867Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-67829","description":"dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.","status":"published","published":"2026-08-28T16:33:49Z","modified":"2026-08-31T18:57:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:19.818565Z"}],"ghsa":[{"id":"GHSA-gpwf-4h98-v82q","title":"datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS","description":"### Impact\nDatadog tracing libraries that implement W3C Trace Context (`tracecontext`) propagation parse the incoming `tracestate` header without enforcing a size cap on the Datadog vendor entry (`dd=...`). The `dd=` value contains semicolon-separated `key:value` pairs, and the parser allocates a hash-map entry for each pair. A remote, unauthenticated attacker can send a `tracestate` header whose `dd=` member is arbitrarily large (or contains an arbitrarily large number of pairs), forcing unbounded CPU and memory consumption per request and enabling a remote Denial of Service. `tracecontext` extraction is enabled by default in affected tracers, so any internet-facing service instrumented with an affected version is exposed unless `tracecontext` has been explicitly removed from the propagation style configuration.\n\n### Patches\nThis is resolved in version 0.3.3 and later of the `dd-trace-rs` library.\n\n### Workarounds\nIf you cannot upgrade immediately:\n1. Disable `tracecontext` extraction by setting `DD_TRACE_PROPAGATION_STYLE_EXTRACT` to a value that does not include `tracecontext` (for example, `datadog`).\n2. Cap the maximum HTTP request header size at an upstream proxy or web server.","status":"published","published":"2026-08-28T16:35:03Z","modified":"2026-08-28T16:35:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:07.031507Z"}],"nvd":[{"id":"CVE-2026-54788","description":"dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.","status":"published","published":"2026-08-28T20:18:17.95Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-54788","title":"dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS","description":"dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.","status":"published","published":"2026-08-28T16:33:49.032Z","modified":"2026-10-28T02:30:48.714270161Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-gpwf-4h98-v82q","title":"datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS","description":"### Impact\nDatadog tracing libraries that implement W3C Trace Context (`tracecontext`) propagation parse the incoming `tracestate` header without enforcing a size cap on the Datadog vendor entry (`dd=...`). The `dd=` value contains semicolon-separated `key:value` pairs, and the parser allocates a hash-map entry for each pair. A remote, unauthenticated attacker can send a `tracestate` header whose `dd=` member is arbitrarily large (or contains an arbitrarily large number of pairs), forcing unbounded CPU and memory consumption per request and enabling a remote Denial of Service. `tracecontext` extraction is enabled by default in affected tracers, so any internet-facing service instrumented with an affected version is exposed unless `tracecontext` has been explicitly removed from the propagation style configuration.\n\n### Patches\nThis is resolved in version 0.3.3 and later of the `dd-trace-rs` library.\n\n### Workarounds\nIf you cannot upgrade immediately:\n1. Disable `tracecontext` extraction by setting `DD_TRACE_PROPAGATION_STYLE_EXTRACT` to a value that does not include `tracecontext` (for example, `datadog`).\n2. Cap the maximum HTTP request header size at an upstream proxy or web server.","status":"published","published":"2026-08-28T16:35:03Z","modified":"2026-08-28T16:55:35.433397Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}