CVE-2026-50270

Datadog's Java APM client dd-trace-java, in versions prior to 1.62.0, fails to enforce the configured baggage limits (DD_TRACE_BAGGAGE_MAX_ITEMS, default 64, and DD_TRACE_BAGGAGE_MAX_BYTES, default 8192) when extracting W3C baggage headers, even though those limits are applied during injection. A remote, unauthenticated attacker can exploit this by sending an HTTP request carrying a baggage header containing a very large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate map entries while parsing the attacker-controlled header on every request. The result is unbounded CPU and memory consumption in any HTTP service where baggage propagation is enabled (the default for most affected tracers), leading to denial of service with no confidentiality or integrity impact (CVSS 3.1: 7.5, CWE-770). All users running dd-trace-java before 1.62.0 with baggage propagation enabled are affected. The issue is fixed in version 1.62.0; it is not listed in CISA's KEV and no public proof of concept or observed exploitation is known.

What to do: Upgrade dd-trace-java (and the bundled dd-java-agent) to version 1.62.0 or later, which enforces the baggage item and byte limits during extraction. If immediate upgrade is not possible, disable baggage propagation by removing 'baggage' from the propagation style (e.g., set DD_TRACE_PROPAGATION_STYLE to tracecontext,B3 without baggage) or enforce ingress controls (WAF or load balancer rules capping the size and item count of the baggage header). Monitor traced Java services for unexplained CPU and memory spikes correlated with inbound requests.