CVE-2026-50273: 
C# vulnerability analysis and mitigation

CVE-2026-50273 is a Denial of Service vulnerability in Datadog's dd-trace-dotnet tracing library caused by improper parsing of W3C baggage HTTP headers. The library parses incoming baggage headers without enforcing item-count or byte-size limits on the extraction path, allowing unbounded CPU and memory consumption. It affects the NuGet packages Datadog.Trace and Datadog.Trace.OpenTracing in all versions prior to 3.43.0. The advisory was originally published on June 5, 2026, and added to the GitHub Advisory Database on July 15, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, DataDog Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The existing limits DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) were only applied to baggage injection (outbound), not extraction (inbound parsing). An attacker can craft an HTTP request with a baggage header containing an arbitrarily large number of comma-separated key-value pairs or a single oversized value; the tracer allocates a hash-map entry for each pair on every request without any cap, exhausting server resources. Because baggage propagation is enabled by default in affected tracers, no special configuration is required to be vulnerable (GitHub Advisory, DataDog Advisory).

Successful exploitation causes unbounded CPU and memory consumption on the targeted service, resulting in a remote Denial of Service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Any internet-facing HTTP service instrumented with an affected version of dd-trace-dotnet and using the default propagation configuration is exposed, potentially causing complete service unavailability for legitimate users (GitHub Advisory).

1. Reconnaissance: Identify internet-facing HTTP services instrumented with Datadog.Trace or Datadog.Trace.OpenTracing NuGet packages below version 3.43.0, using version disclosure headers or known deployment patterns.
2. Craft malicious request: Construct an HTTP request with an oversized baggage header — either containing a very large number of comma-separated key-value pairs (e.g., key1=val1,key2=val2,...,keyN=valN with thousands of entries) or a single extremely large value exceeding normal bounds.
3. Send request to target: Transmit the crafted request to any HTTP endpoint of the vulnerable service. No authentication or special path is required — any endpoint processed by the instrumented tracer is sufficient.
4. Trigger resource exhaustion: The tracer's extraction logic allocates a hash-map entry for each baggage pair without limit, consuming increasing CPU and memory on each request.
5. Sustain DoS: Repeat the request in rapid succession to maintain resource pressure, causing the service to become unresponsive or crash due to memory exhaustion (GitHub Advisory, DataDog Advisory).

• Network: Repeated HTTP requests to any service endpoint containing abnormally large or numerous baggage header values (e.g., headers exceeding 8 KB or containing hundreds of comma-separated key-value pairs).
• Logs: Web server or proxy access logs showing requests with unusually large header sizes from a single or rotating set of source IPs; application logs showing memory allocation errors or out-of-memory exceptions in the Datadog tracer.
• Process: Sudden spikes in CPU and memory usage by the .NET application process correlating with incoming HTTP traffic; process crashes or restarts due to memory exhaustion.
• Application Metrics: Datadog APM or infrastructure metrics showing abnormal memory growth or GC pressure coinciding with elevated request rates (GitHub Advisory).

Upgrade Datadog.Trace and Datadog.Trace.OpenTracing NuGet packages to version 3.43.0 or later, which enforces extraction-side limits on baggage header parsing. If immediate upgrade is not possible, apply one or both of the following workarounds: (1) Disable baggage extraction by removing baggage from the DD_TRACE_PROPAGATION_STYLE environment variable (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently); (2) Cap the maximum HTTP request header size at an upstream proxy or web server using directives such as Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb (GitHub Advisory, DataDog Advisory).

The advisory references related upstream vulnerabilities in OpenTelemetry libraries (opentelemetry-go GHSA-mh2q-q3fh-2475 and opentelemetry-dotnet GHSA-g94r-2vxg-569j), suggesting this is part of a broader pattern of missing extraction-side limits in W3C baggage propagation implementations across the observability ecosystem. No notable public researcher commentary or significant social media discussion has been identified beyond the official advisory (GitHub Advisory).