{"id":"CVE-2026-50277","summary":"dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS","details":"dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very large value, causing per-request hash-map allocation and unbounded CPU and memory consumption. Baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, so affected internet-facing services can be denied service. This issue is fixed in version 2.1.0.","aliases":["GHSA-ch7h-phmx-rqwq"],"modified":"2026-09-19T08:14:26.188560Z","published":"2026-09-17T20:16:37.230Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50277.json"},"references":[{"type":"WEB","url":"https://github.com/DataDog/dd-trace-cpp/releases/tag/v2.1.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50277.json"},{"type":"ADVISORY","url":"https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-ch7h-phmx-rqwq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50277"},{"type":"FIX","url":"https://github.com/DataDog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666"},{"type":"FIX","url":"https://github.com/DataDog/dd-trace-cpp/pull/313"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/datadog/dd-trace-cpp","events":[{"introduced":"0"},{"fixed":"422dc91bb93e358e3977381275d311f3f926d666"},{"fixed":"4412e16c284b238375d2e41dd5bc297007f4f541"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.1.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2.0.0","v1.0.0","v0.2.2","v0.2.1","v0.2.0","v0.1.12","v0.1.11","v0.1.10","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50277.json","vanir_signatures_modified":"2026-09-19T08:14:26Z","vanir_signatures":[{"id":"CVE-2026-50277-013fa94a","signature_type":"Function","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"src/datadog/tracer.cpp","function":"Tracer::extract_baggage"},"deprecated":false,"digest":{"function_hash":"224479716267846172300669952024393856607","length":576}},{"id":"CVE-2026-50277-246ba025","signature_type":"Function","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541","target":{"function":"TraceSegment::make_sampling_decision_if_null","file":"src/datadog/trace_segment.cpp"},"deprecated":false,"digest":{"function_hash":"266132350467458871403181516730065194836","length":829}},{"signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541","target":{"file":"src/datadog/trace_segment.cpp"},"deprecated":false,"digest":{"line_hashes":["85205526672945050702103165735692613339","217932444524702398203590216791177261845","138257647346547042677017042117157701343","284733783213817760575518320260611721614","230221863654289187088705673984214270463","108587633537507210242609878158511307392","166562729874665529044791448594841845879","250318724918239863406315277729419840635","141820254050139657803633893699962041143","337949160333293935851424666620361318134","196312749931560883608386023052686035533","154631684564252420157893585231365155737","313448949655180564010973989122600442320","299858224066908807181824517043898310524","30010691778295181884299438050046188928","126106594443245104774750970396568568984","104169346869990079121562388850364265267","215026970037981025906212150417669814885","207856770746052281964008810459578639309","133082035636541680982180752935704674842","42569621367742354669769612689991352791","36052307541049860791887339599248465812","244474608711493247444175456797355145725","139841534153349272477787002742904667341","57588092190634299082344892320779110333","246298178125313530949497452470099720887","227133364493520014580506981498460916327"],"threshold":0.9},"id":"CVE-2026-50277-27a0b958","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["200484139372890239760378008461073702468","211526129731435034692768618950522690353","192382464883828658406268978865836403789","91867275185150755406262696129947824811","301506281495705383114850107997796520275","195473780079535026175498186238658799427","16335844807748973021171374372340370858","96041772745963263508520038422754658207"],"threshold":0.9},"id":"CVE-2026-50277-344c62c0","signature_type":"Line","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541","target":{"file":"test/test_trace_segment.cpp"}},{"id":"CVE-2026-50277-34f23d22","signature_type":"Line","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"test/test_tracer.cpp"},"deprecated":false,"digest":{"line_hashes":["159651601263021419263654684983416319718","52262735322077478522312991233557285938","84541050633726552818264863705199950511","105254968638279188734891742666817977608","274936128515996365398147868047039475538","108587633537507210242609878158511307392","268006568146430569581215389817049643614"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["104162021934632812242804113200542334891","146679231008598244416816940305462705411","283176437196917362741878973138773717896","229214866727964981947905635657256307001","157763728101060601013417926522756686804","232947747528079841230929071317366885371","327219894532985620841477320707411364472","249536680391366858348506658730551869904","253927373574784304560858477580444637675","63062536652791254781716535157264029526","187491089232925346868203540009949367045","110803466745383675688071914320705861192","40237879949430338642596253868964799179","67754073654403281123624511290486655112"],"threshold":0.9},"id":"CVE-2026-50277-3753a528","signature_type":"Line","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"test/test_trace_segment.cpp"}},{"deprecated":false,"digest":{"line_hashes":["105613664600482121504959646489580717361","131056707175541226960767445262429703885","93433526158033273365097876697507329439","75223489136400023289009831262044638486"],"threshold":0.9},"id":"CVE-2026-50277-41ebcacb","signature_type":"Line","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541","target":{"file":"include/datadog/version.h"}},{"deprecated":false,"digest":{"line_hashes":["223149217427653476650641915890500954342","287293014278599225291121618483169901483","34860673376011095884324302672848039591","36011255611162508908289989583855590910"],"threshold":0.9},"id":"CVE-2026-50277-4e52289e","signature_type":"Line","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"include/datadog/baggage.h"}},{"deprecated":false,"digest":{"line_hashes":["26639510820851854839800887051813200168","57593032458079180178519604593228862564","304660887562709851099342648645280572775","129992566206783704027697317368241388288","102516503055350713628704010399963440007"],"threshold":0.9},"id":"CVE-2026-50277-5e2be9c8","signature_type":"Line","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/4412e16c284b238375d2e41dd5bc297007f4f541","target":{"file":"src/datadog/version.cpp"}},{"source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"src/datadog/tracer.cpp"},"deprecated":false,"digest":{"line_hashes":["156049907992563847372448269071408353675","191474336665296801096795513886498672903","64778751313588164570375910894514750054","71323694874574242046173711945662795558"],"threshold":0.9},"id":"CVE-2026-50277-6d1f368f","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"src/datadog/baggage.cpp"},"deprecated":false,"digest":{"line_hashes":["68492631196957930185837915469096386614","168507825181607500348837005332212982359","241962131681022930778979852842192348312","334076304336273605260156422568362442561","294457367243370323199480894529901784729","38261828991320048906732014511339589262","310251191590670796241628268999787510130","281788044779721876173524135706599585436","13197533497422051986593185596802656189","26121670259560863816429389752036914462","217709937183521914895706268878121177024","298504102867983686180410577832008491390","277122708944163363358480863208728804830","216382020102487272547505309422720944315","260529276054893427066173129555657158054","261101148370560045745696552948664056219","186842775373940939022063941748900863950","335269598353153162839590933952629265522","126478341219269246620618028357245322556","141158824319894339262411011521858808655","158411602857567976600202839299475155840","237218251746389582507073095460825883634","154486679274149931753277171443793214320","29979600683402918289269491405062699833","177638623129376437738982253369227438262","144012126488593976559673752960630878952","250898855018885663233820841577309056315","243915166580458329614994063231383186595","28032369941419596162611671121748243630","75165913535536121673205408333514817353","70344531447879445923988377004311047213","72890336460548282136548701528394895522","250803113763337715096162007210545324100","11423171170957600994250636653281279082","9753280904342403714017120438649859730"],"threshold":0.9},"id":"CVE-2026-50277-7103278f","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"src/datadog/w3c_propagation.cpp","function":"extract_tracestate"},"deprecated":false,"digest":{"function_hash":"107099478987533353180109564085331057489","length":537},"id":"CVE-2026-50277-9016c506"},{"digest":{"line_hashes":["127673964837931770327047682516563228265","322655099510793347177064694659456044472","121605486081983305001896630946771570662","54105043811352513759759477456110313007"],"threshold":0.9},"id":"CVE-2026-50277-ba8b5329","signature_type":"Line","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"src/datadog/extraction_util.cpp"},"deprecated":false},{"source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"function":"parse_baggage","file":"src/datadog/baggage.cpp"},"deprecated":false,"digest":{"function_hash":"293560209042559291315995340571765651667","length":2923},"id":"CVE-2026-50277-c67fd1bf","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"src/datadog/baggage.cpp","function":"Baggage::extract"},"deprecated":false,"digest":{"function_hash":"304842661891554424357766059542028388994","length":281},"id":"CVE-2026-50277-cbb26a53"},{"digest":{"line_hashes":["197555705105413861768283091323362145311","25314519238787370653731226925776283092","157991875332229184021791245986804475248","123442669274281144842916633327488808540"],"threshold":0.9},"id":"CVE-2026-50277-cc9300ec","signature_type":"Line","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"test/test_baggage.cpp"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["201159436115795120775320885628054351194","298067269043124223976657605963096354713","245412528634261233046995308983875773733","160732898208425170299339232146962905023","201279199425233646291385469658458786783","63875229341819944322706741701001081122","162683187970176517870382012345328235982","165868847768045429144281016341350502421","247086581314649410405093944834150077215","266762780906562514383651583164767950743","46593207362876291970340878246657502137"],"threshold":0.9},"id":"CVE-2026-50277-e7e05e6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/datadog/dd-trace-cpp/commit/422dc91bb93e358e3977381275d311f3f926d666","target":{"file":"src/datadog/w3c_propagation.cpp"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}