CVE-2026-50273

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50273
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50273.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50273
Aliases
Published
2026-07-17T18:01:14.533Z
Modified
2026-07-19T03:46:31.694615580Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
Details

Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50273.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ]
}
References

Affected packages

Git / github.com/datadog/dd-trace-dotnet

Affected ranges

Type
GIT
Repo
https://github.com/datadog/dd-trace-dotnet
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
38092e0d41a36decbe649e048e48ae1b1607292f
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.43.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.2.0
v0.2.2
v0.2.4-alpha
v0.3.0-beta
v0.3.1-beta
v0.3.2-beta
v0.4.0-beta
v0.4.1-beta
v0.5.0-beta
v0.5.1-beta
v0.5.2-beta
v0.6.0-beta
v0.7.0-beta
v0.7.1-beta
v0.8.0-beta
v0.8.1-beta
v0.8.2-beta
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.10.1-prerelease
v1.10.2-prerelease
v1.10.3-prerelease
v1.11.0
v1.11.1-prerelease
v1.12.0
v1.13.0
v1.13.1-prerelease
v1.13.2
v1.13.3-prerelease
v1.13.4-prerelease
v1.14.0
v1.14.1-prerelease
v1.14.2
v1.14.3-prerelease
v1.15.0
v1.15.1-prerelease
v1.16.0
v1.16.1
v1.16.2
v1.16.3-prerelease
v1.17.0
v1.17.1-prerelease
v1.18.0
v1.18.1-prerelease
v1.18.2
v1.18.3
v1.18.4-prerelease
v1.19.0
v1.19.2
v1.19.3
v1.19.5
v1.19.6-prerelease
v1.2.0
v1.20.0
v1.20.1-prerelease
v1.21.0
v1.21.1
v1.21.2-prerelease
v1.22.0
v1.22.2-prerelease
v1.23.0
v1.24.0
v1.25.0
v1.25.1-prerelease
v1.25.2-prerelease
v1.26.0
v1.26.1
v1.26.2
v1.26.3
v1.27.0
v1.28.0
v1.28.1-prerelease
v1.28.2
v1.28.3-prerelease
v1.28.5-prerelease
v1.28.6
v1.28.8
v1.29.0
v1.3.0
v1.3.1
v1.30.0
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.0-beta1
v1.8.0
v1.9.0
v1.9.1-prerelease
v2.*
v2.0.0-prerelease
v2.0.1
v2.1.0
v2.1.1-profiler-beta1
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.29.0
v2.3.0
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v2.36.0
v2.37.0
v2.38.0
v2.39.0
v2.4.0
v2.40.0
v2.41.0
v2.42.0
v2.43.0
v2.44.0
v2.45.0
v2.46.0
v2.47.0
v2.48.0
v2.49.0
v2.5.0
v2.5.1
v2.50.0
v2.51.0
v2.52.0
v2.53.0
v2.54.0
v2.55.0
v2.56.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0
v3.*
v3.0.0-prerelease
v3.1.0-prerelease
v3.10.0
v3.11.0
v3.12.0
v3.13.0
v3.14.0
v3.15.0
v3.16.0
v3.17.0
v3.18.0
v3.19.0
v3.2.0
v3.20.0
v3.21.0
v3.22.0
v3.23.0
v3.24.0
v3.25.0
v3.26.0
v3.27.0
v3.28.0
v3.29.0
v3.3.0
v3.30.0
v3.31.0
v3.32.0
v3.33.0
v3.34.0
v3.35.0
v3.36.0
v3.37.0
v3.38.0
v3.39.0
v3.4.0
v3.40.0
v3.41.0
v3.42.0
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50273.json"