CVE-2026-54788: 
Rust vulnerability analysis and mitigation

CVE-2026-54788 is a Denial of Service vulnerability in the datadog-opentelemetry Rust crate (part of the dd-trace-rs library) caused by unbounded parsing of the W3C tracestate HTTP header. The parser in datadog-opentelemetry/src/propagation/tracecontext.rs collects all semicolon-separated key:value pairs from the Datadog dd=... vendor entry into a HashMap without enforcing any count or size limit, allowing a remote unauthenticated attacker to exhaust CPU and memory resources. Affected versions are >= 0.1.0, < 0.3.3 of the datadog-opentelemetry crate. The advisory was originally published on June 22, 2026, and added to the GitHub Advisory Database on August 28, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, DataDog Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable code in datadog-opentelemetry/src/propagation/tracecontext.rs parses the tracestate HTTP header's dd=... vendor entry by splitting on semicolons and inserting each key:value pair into a HashMap with no cap on the number of entries or total size. Because tracecontext extraction is enabled by default, any HTTP request reaching an instrumented service can carry a crafted tracestate header with an arbitrarily large dd= value, triggering unbounded memory allocation and CPU consumption per request without requiring authentication or special privileges (Github Advisory, Fix PR).

Successful exploitation causes excessive CPU and memory consumption on the affected service for each malicious request, potentially leading to out-of-memory crashes or severe performance degradation — effectively a remote Denial of Service. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. Any internet-facing Rust service instrumented with datadog-opentelemetry versions 0.1.0 through 0.3.2 is exposed by default, as tracecontext propagation is enabled without explicit configuration changes (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The EPSS score is 0.562% (44th percentile), indicating a low but non-negligible probability of exploitation within 30 days. The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any attacker who can send HTTP requests to an affected service. It is not currently listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing services instrumented with datadog-opentelemetry versions 0.1.0–0.3.2 (e.g., via HTTP response headers, error messages, or open-source intelligence indicating Rust/Datadog APM usage).
2. Craft malicious request: Construct an HTTP request containing a tracestate header with an oversized dd= vendor entry — either a very large number of semicolon-separated key:value pairs (e.g., dd=k1:v1;k2:v2;...;kN:vN with thousands of pairs) or pairs with very large individual values.
3. Send request: Transmit the crafted request to any endpoint of the target service. No authentication or special headers beyond tracestate are required.
4. Trigger resource exhaustion: The vulnerable parser allocates a HashMap entry for each pair without limit, consuming unbounded CPU and memory. Repeating this across multiple concurrent requests amplifies the effect, potentially causing OOM crashes or service unavailability (Github Advisory, Fix PR).

• Network: Incoming HTTP requests containing abnormally large tracestate headers, particularly with a dd= entry containing an unusually high number of semicolon-separated pairs or very long values; repeated such requests from the same or rotating source IPs.
• Process/System: Sudden spikes in memory consumption or CPU usage by the instrumented Rust service process coinciding with incoming HTTP traffic; OOM killer events in system logs (dmesg, /var/log/syslog) referencing the service process.
• Logs: Application or web server access logs showing requests with oversized tracestate header values; upstream proxy logs (e.g., nginx, HAProxy) recording unusually large header sizes from specific clients.

Upgrade the datadog-opentelemetry crate to version 0.3.3 or later, which limits tracestate parsing to a maximum of 32 key:value pairs per dd= entry (DataDog Release). If an immediate upgrade is not possible, apply one or both of the following workarounds: (1) Disable tracecontext extraction by setting the environment variable DD_TRACE_PROPAGATION_STYLE_EXTRACT to a value that excludes tracecontext (e.g., datadog); (2) Cap the maximum HTTP request header size at an upstream proxy or web server (e.g., nginx large_client_header_buffers) to prevent oversized tracestate headers from reaching the application (Github Advisory).