CVE-2026-54788

dd-trace-rs versions 0.1.0 until 0.3.3 contain an unbounded resource allocation flaw (CWE-770) in the W3C tracestate header parser (datadog-opentelemetry/src/propagation/tracecontext.rs), which collects every semicolon-separated key/value pair in the Datadog dd=... vendor entry into a HashMap without any limit on pair count or entry size. Because trace-context extraction is enabled by default, any remote unauthenticated attacker who can send requests to an instrumented network service can trigger the flaw simply by including an arbitrarily large dd=... entry in the tracestate header. Each crafted request forces excessive CPU and memory consumption, which an attacker can repeat to exhaust resources and cause denial of service, with no impact on confidentiality or integrity. Any Rust service instrumented with dd-trace-rs in the affected range that processes untrusted inbound traffic is exposed. There is no evidence of exploitation in the wild and no public proof-of-concept; EPSS estimates about a 0.6% probability of exploitation within 30 days.

What to do: Upgrade dd-trace-rs to 0.3.3 or later. As an interim mitigation, disable tracecontext propagation extraction in datadog-opentelemetry or cap/strip oversized W3C tracestate headers at your reverse proxy or load balancer. Inventory Rust services that link dd-trace-rs and confirm whether they process unauthenticated inbound requests with default propagation settings.