{"id":"PYSEC-2026-3461","summary":"dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS","details":"### Impact\nDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled.\nThe baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.\n\n### Patches\nThis is resolved in version 4.8.2 and later of the `dd-trace-py` library\n\n### Workarounds\nIf users cannot upgrade immediately:\n1. Disable `baggage` extraction by removing `baggage` from `DD_TRACE_PROPAGATION_STYLE` (or `DD_TRACE_PROPAGATION_STYLE_EXTRACT` if set independently).\n2. Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache `LimitRequestFieldSize`, Nginx `large_client_header_buffers`, Envoy `max_request_headers_kb`).\n\n\n### Resources\nRelated upstream advisories:\n[opentelemetry-go GHSA-mh2q-q3fh-2475](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475)\n[opentelemetry-dotnet GHSA-g94r-2vxg-569j](https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j)","aliases":["CVE-2026-50271","GHSA-mw54-j2v2-42hr"],"modified":"2026-07-23T15:00:11.420190209Z","published":"2026-07-23T11:41:46.329438Z","references":[{"type":"WEB","url":"https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-mw54-j2v2-42hr"},{"type":"PACKAGE","url":"https://github.com/DataDog/dd-trace-py"},{"type":"PACKAGE","url":"https://pypi.org/project/ddtrace"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mw54-j2v2-42hr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50271"}],"affected":[{"package":{"name":"ddtrace","ecosystem":"PyPI","purl":"pkg:pypi/ddtrace"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.2"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.21.1","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.27.1","0.28.0","0.29.0","0.30.0","0.30.1","0.30.2","0.31.0","0.32.0","0.32.1","0.32.2","0.33.0","0.34.0","0.34.1","0.34.2","0.35.0","0.35.1","0.35.2","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.37.3","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.39.0","0.39.1","0.39.2","0.40.0","0.40.1","0.40.2","0.41.0","0.41.1","0.41.2","0.42.0","0.43.0","0.43.1","0.44.0","0.45.0","0.46.0","0.47.0","0.48.0","0.48.1","0.48.2","0.48.3","0.48.4","0.49.0","0.49.0rc1","0.49.0rc2","0.49.1","0.49.2","0.49.3","0.49.4","0.5.3","0.5.4","0.5.5","0.50.0","0.50.0rc1","0.50.0rc2","0.50.0rc3","0.50.0rc4","0.50.0rc5","0.50.0rc6","0.50.0rc7","0.50.1","0.50.2","0.50.3","0.50.4","0.51.0","0.51.0rc1","0.51.0rc2","0.51.0rc3","0.51.0rc4","0.51.1","0.51.2","0.51.3","0.52.0","0.52.0rc1","0.52.0rc3","0.52.1","0.52.2","0.53.0","0.53.0rc1","0.53.0rc2","0.53.1","0.53.2","0.53.3","0.54.0","0.54.0rc1","0.54.1","0.55.0","0.55.0rc1","0.55.0rc2","0.55.1","0.55.2","0.55.3","0.55.4","0.56.0","0.56.0rc1","0.56.0rc2","0.56.0rc3","0.56.0rc4","0.56.0rc5","0.56.0rc6","0.56.0rc7","0.56.1","0.57.0","0.57.0rc1","0.57.0rc2","0.57.0rc3","0.57.1","0.57.2","0.57.3","0.57.4","0.58.0","0.58.0rc1","0.58.1","0.58.2","0.58.3","0.58.4","0.58.5","0.59.0","0.59.0rc1","0.59.0rc2","0.59.0rc3","0.59.1","0.59.2","0.6.0","0.60.0","0.60.0rc1","0.60.0rc2","0.60.0rc3","0.60.0rc4","0.60.0rc5","0.60.1","0.60.2","0.60.3","0.60.4","0.60.5","0.60.6","0.61.0","0.61.0rc1","0.61.0rc2","0.61.1","0.61.2","0.61.3","0.61.4","0.61.5","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.9.0","0.9.1","0.9.2","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.0.1","1.0.2","1.0.3","1.1.0","1.1.0rc1","1.1.0rc2","1.1.0rc3","1.1.1","1.1.2","1.1.3","1.1.4","1.10.0","1.10.0rc1","1.10.0rc2","1.10.0rc3","1.10.1","1.10.2","1.10.3","1.11.0","1.11.0rc1","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.12.0","1.12.0rc1","1.12.1","1.12.10","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9","1.13.0","1.13.0rc1","1.13.0rc2","1.13.0rc3","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.14.0","1.14.0rc1","1.14.0rc2","1.14.1","1.14.2","1.14.3","1.15.0","1.15.0rc1","1.15.1","1.15.2","1.16.0","1.16.0rc1","1.16.0rc2","1.16.1","1.16.2","1.16.3","1.16.4","1.17.0","1.17.0rc1","1.17.1","1.17.2","1.17.3","1.17.4","1.17.5","1.17.6","1.18.0","1.18.0rc1","1.18.1","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.19.0","1.19.0rc1","1.19.1","1.19.2","1.19.3","1.19.4","1.19.5","1.19.6","1.19.7","1.2.0","1.2.0rc1","1.2.0rc2","1.2.0rc3","1.2.1","1.2.1rc1","1.2.2","1.2.3","1.20.0","1.20.0rc1","1.20.1","1.20.10","1.20.11","1.20.12","1.20.13","1.20.14","1.20.15","1.20.16","1.20.17","1.20.18","1.20.19","1.20.2","1.20.3","1.20.4","1.20.5","1.20.6","1.20.7","1.20.8","1.20.9","1.3.0","1.3.0rc1","1.3.0rc2","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.4.0","1.4.0rc1","1.4.0rc2","1.4.0rc3","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.0rc1","1.5.0rc2","1.5.0rc3","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0rc1","1.6.0rc2","1.6.0rc3","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.7.0","1.7.0rc1","1.7.0rc2","1.7.0rc3","1.7.0rc4","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.8.0","1.8.0rc1","1.8.0rc2","1.8.0rc3","1.8.0rc4","1.8.1","1.8.2","1.8.3","1.9.0","1.9.0rc2","1.9.0rc3","1.9.0rc4","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","2.0.0","2.0.0rc2","2.0.1","2.0.10","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0rc1","2.1.0rc2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.10.0","2.10.0rc1","2.10.0rc2","2.10.0rc3","2.10.0rc4","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.11.0","2.11.0rc1","2.11.0rc2","2.11.1","2.11.2","2.11.3","2.11.4","2.11.5","2.11.6","2.11.7","2.11.8","2.12.0","2.12.0rc1","2.12.0rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.0rc1","2.13.1","2.13.2","2.13.3","2.14.0","2.14.0rc1","2.14.1","2.14.2","2.14.4","2.14.5","2.14.6","2.14.7","2.15.0","2.15.0rc1","2.15.0rc2","2.15.0rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0rc1","2.16.0rc2","2.16.1","2.16.2","2.16.3","2.16.4","2.16.5","2.16.6","2.17.0","2.17.0rc1","2.17.0rc2","2.17.1","2.17.2","2.17.3","2.17.4","2.17.5","2.18.0","2.18.0rc1","2.18.1","2.18.2","2.19.0","2.19.0rc1","2.19.0rc2","2.19.1","2.19.2","2.19.3","2.19.4","2.2.0","2.2.0rc1","2.2.1","2.2.2","2.2.3","2.20.0","2.20.0rc1","2.20.1","2.20.2","2.21.0","2.21.0rc1","2.21.1","2.21.10","2.21.11","2.21.12","2.21.2","2.21.3","2.21.4","2.21.5","2.21.5rc1","2.21.6","2.21.7","2.21.8","2.21.9","2.3.0","2.3.0rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0rc1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.0rc1","2.5.0rc2","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.0rc1","2.7.1","2.7.10","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.0","2.8.0rc1","2.8.0rc2","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.9.0","2.9.0rc1","2.9.0rc2","2.9.0rc3","2.9.0rc4","2.9.0rc5","2.9.0rc6","2.9.0rc7","2.9.0rc8","2.9.0rc9","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","3.0.0","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.1.0","3.1.0rc1","3.1.1","3.10.0","3.10.0rc1","3.10.0rc2","3.10.0rc3","3.10.1","3.10.2","3.10.3","3.10.4","3.11.0","3.11.0rc1","3.11.0rc2","3.11.0rc3","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.0rc1","3.12.0rc2","3.12.0rc3","3.12.1","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6","3.12.7","3.12.8","3.12.9","3.13.0","3.13.0rc1","3.13.1","3.13.2","3.13.3","3.13.4","3.14.0","3.14.0rc1","3.14.0rc2","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0rc1","3.15.1","3.16.0","3.16.0rc1","3.16.0rc2","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0rc1","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0rc1","3.18.0rc2","3.18.1","3.19.0","3.19.0rc1","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5","3.19.6","3.19.7","3.19.8","3.2.0","3.2.0rc1","3.2.1","3.2.1rc1","3.2.1rc2","3.2.2","3.2.3","3.3.0","3.3.0rc3","3.3.1","3.3.2","3.3.3","3.4.0","3.4.0rc1","3.4.0rc2","3.4.1","3.4.2","3.5.0","3.5.0rc1","3.5.1","3.6.0","3.6.0rc1","3.7.0","3.7.0rc1","3.7.0rc2","3.7.1","3.7.2","3.8.0","3.8.0rc1","3.8.0rc2","3.8.0rc3","3.8.1","3.9.0","3.9.0rc1","3.9.0rc2","3.9.1","3.9.2","3.9.3","3.9.4","4.0.0","4.0.0rc1","4.0.0rc2","4.0.0rc3","4.0.1","4.0.2","4.0.3","4.0.4","4.1.0","4.1.0rc2","4.1.0rc3","4.1.1","4.1.2","4.1.3","4.1.4","4.2.0","4.2.0rc1","4.2.0rc2","4.2.0rc3","4.2.1","4.2.2","4.2.3","4.3.0","4.3.0rc1","4.3.1","4.3.2","4.4.0","4.4.0rc1","4.4.0rc2","4.4.0rc3","4.5.0","4.5.0rc1","4.5.0rc2","4.5.0rc3","4.5.0rc4","4.5.1","4.5.10","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.5.8","4.5.9","4.6.0","4.6.0rc1","4.6.0rc2","4.6.0rc3","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.6.6","4.6.7","4.6.8","4.7.0","4.7.0rc1","4.7.0rc2","4.7.0rc3","4.7.0rc4","4.7.0rc5","4.7.1","4.7.2","4.8.0","4.8.0rc1","4.8.0rc2","4.8.0rc3","4.8.0rc4","4.8.0rc5","4.8.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/ddtrace/PYSEC-2026-3461.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}