{"id":"CVE-2026-54788","summary":"dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS","details":"dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.","aliases":["GHSA-gpwf-4h98-v82q"],"modified":"2026-09-11T03:30:46.739709130Z","published":"2026-08-28T16:33:49.032Z","database_specific":{"cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54788.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/DataDog/dd-trace-rs/releases/tag/datadog-opentelemetry-v0.3.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54788.json"},{"type":"ADVISORY","url":"https://github.com/DataDog/dd-trace-rs/security/advisories/GHSA-gpwf-4h98-v82q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54788"},{"type":"FIX","url":"https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71d0ea8103da0e6cf4cd50677ffacd2"},{"type":"FIX","url":"https://github.com/DataDog/dd-trace-rs/pull/218"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/datadog/dd-trace-rs","events":[{"introduced":"23222698c5c904a85d3faee9779519ae6a9da9d2"},{"fixed":"77c5d185c71d0ea8103da0e6cf4cd50677ffacd2"},{"fixed":"7ee480b34b0ae9b0f66ee704d663b6555ec7a823"}],"database_specific":{"extracted_events":[{"introduced":"0.1.0"},{"fixed":"0.3.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["datadog-opentelemetry-v0.3.2","datadog-opentelemetry-v0.3.1","datadog-opentelemetry-v0.3.0","datadog-opentelemetry-v0.3.0-alpha.1","datadog-opentelemetry-v0.2.1","datadog-opentelemetry-v0.2.0","datadog-opentelemetry-v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54788.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}