CVE-2026-54788 dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-54788?
CVE-2026-54788 is a high-severity vulnerability in DataDog dd-trace-rs, published on 28 Aug 2026.
Official description
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.
Weakness: CWE-770
Which versions are affected by CVE-2026-54788?
2 open source packages ship an affected version, including datadog-opentelemetry.
| Package | Affected | Fixed in |
|---|---|---|
datadog-opentelemetry crates.io | From 0.1.0 | 0.3.3 |
datadog-opentelemetry crates.io | From 0.1.0 | 0.3.3 |
How do I fix CVE-2026-54788?
Upgrade datadog-opentelemetry to 0.3.3 or later.
Is CVE-2026-54788 being exploited?
There is no known exploitation of CVE-2026-54788 in the wild and no public exploit code.
Sources
Also known as GHSA-gpwf-4h98-v82q.