CVE-2026-50274 dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
A remote attacker can cause denial of service in applications using dd-trace-go by sending oversized W3C baggage headers that bypass resource limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50274?
CVE-2026-50274 is a high-severity denial of service vulnerability in DataDog dd-trace-go, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.
Weakness: CWE-770
Which versions are affected by CVE-2026-50274?
6 open source packages ship an affected version, including github.com/DataDog/dd-trace-go and github.com/DataDog/dd-trace-go/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/DataDog/dd-trace-go Go | All versions | None |
github.com/DataDog/dd-trace-go Go | All versions to 1.24.1 | None |
github.com/DataDog/dd-trace-go Go | All versions to 1.24.1 | None |
github.com/DataDog/dd-trace-go/v2 Go | All versions | 2.8.1 |
github.com/DataDog/dd-trace-go/v2 Go | All versions | 2.8.1 |
github.com/DataDog/dd-trace-go/v2 Go | All versions | 2.8.1 |
How do I fix CVE-2026-50274?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-50274 being exploited?
There is no known exploitation of CVE-2026-50274 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-ES07258, CLEANSTART-2026-TC25973, GHSA-74j5-xf3v-crq8, GO-2026-6000, MINI-2m2c-2v8f-3mwj, MINI-2p7r-r786-r3x8 and 40 more.