CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
Remote attackers can cause denial of service by sending oversized W3C baggage headers to applications using the Datadog PHP Tracer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-50275?
CVE-2026-50275 is a high-severity denial of service vulnerability in DataDog dd-trace-php, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send an arbitrarily large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate hash-map entries and consume unbounded CPU and memory on each request. Baggage extraction is enabled by default in most affected deployments unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT. This issue is fixed in version 1.19.2.
Weakness: CWE-770
Which versions are affected by CVE-2026-50275?
How do I fix CVE-2026-50275?
No fix has been published for CVE-2026-50275 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-50275 being exploited?
There is no known exploitation of CVE-2026-50275 in the wild and no public exploit code.
Sources
Also known as GHSA-phwx-ww2p-cv9v.