High [CVE-2026-50274] Datadog dd-trace-go: Denial of Service via malicious baggage headers
This high-severity Red Hat Linux advisory covers CVE-2026-50274 affecting Red Hat Advanced Cluster Management for Kubernetes 2.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path.
A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.
Red Hat Advanced Cluster Management for Kubernetes and OpenShift Container Platform 4.21+ ship versions of the Datadog dd-trace-go v2 library prior to v2.8.1 that are vulnerable to this denial-of-service flaw in W3C baggage header parsing. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-770. Red Hat does not currently list a fixing RHSA for this CVE.
Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
- < 2.8.1
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Mitigation checklist
- If Datadog APM tracing with W3C baggage propagation is enabled, disable the baggage propagator by setting the DD_TRACE_PROPAGATION_STYLE environment variable to exclude 'baggage'.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.