CVE-2026-50273

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50273
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50273.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50273
Aliases
Published
2026-07-17T18:01:14Z
Modified
2026-08-12T03:51:13Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
Details

Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50273.json"
}
References

Affected packages

Git / github.com/datadog/dd-trace-dotnet

Affected ranges

Type
GIT
Repo
https://github.com/datadog/dd-trace-dotnet
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
38092e0d41a36decbe649e048e48ae1b1607292f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.43.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.2.0
v0.2.2
v0.2.4-alpha
v0.3.0-beta
v0.3.1-beta
v0.3.2-beta
v0.4.0-beta
v0.4.1-beta
v0.5.0-beta
v0.5.1-beta
v0.5.2-beta
v0.6.0-beta
v0.7.0-beta
v0.7.1-beta
v0.8.0-beta
v0.8.1-beta
v0.8.2-beta
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.10.1-prerelease
v1.10.2-prerelease
v1.10.3-prerelease
v1.11.0
v1.11.1-prerelease
v1.12.0
v1.13.0
v1.13.1-prerelease
v1.13.2
v1.13.3-prerelease
v1.13.4-prerelease
v1.14.0
v1.14.1-prerelease
v1.14.2
v1.14.3-prerelease
v1.15.0
v1.15.1-prerelease
v1.16.0
v1.16.1
v1.16.2
v1.16.3-prerelease
v1.17.0
v1.17.1-prerelease
v1.18.0
v1.18.1-prerelease
v1.18.2
v1.18.3
v1.18.4-prerelease
v1.19.0
v1.19.2
v1.19.3
v1.19.5
v1.19.6-prerelease
v1.2.0
v1.20.0
v1.20.1-prerelease
v1.21.0
v1.21.1
v1.21.2-prerelease
v1.22.0
v1.22.2-prerelease
v1.23.0
v1.24.0
v1.25.0
v1.25.1-prerelease
v1.25.2-prerelease
v1.26.0
v1.26.1
v1.26.2
v1.26.3
v1.27.0
v1.28.0
v1.28.1-prerelease
v1.28.2
v1.28.3-prerelease
v1.28.5-prerelease
v1.28.6
v1.28.8
v1.29.0
v1.3.0
v1.3.1
v1.30.0
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.0-beta1
v1.8.0
v1.9.0
v1.9.1-prerelease
v2.*
v2.0.0-prerelease
v2.0.1
v2.1.0
v2.1.1-profiler-beta1
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.29.0
v2.3.0
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v2.36.0
v2.37.0
v2.38.0
v2.39.0
v2.4.0
v2.40.0
v2.41.0
v2.42.0
v2.43.0
v2.44.0
v2.45.0
v2.46.0
v2.47.0
v2.48.0
v2.49.0
v2.5.0
v2.5.1
v2.50.0
v2.51.0
v2.52.0
v2.53.0
v2.54.0
v2.55.0
v2.56.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0
v3.*
v3.0.0-prerelease
v3.1.0-prerelease
v3.10.0
v3.11.0
v3.12.0
v3.13.0
v3.14.0
v3.15.0
v3.16.0
v3.17.0
v3.18.0
v3.19.0
v3.2.0
v3.20.0
v3.21.0
v3.22.0
v3.23.0
v3.24.0
v3.25.0
v3.26.0
v3.27.0
v3.28.0
v3.29.0
v3.3.0
v3.30.0
v3.31.0
v3.32.0
v3.33.0
v3.34.0
v3.35.0
v3.36.0
v3.37.0
v3.38.0
v3.39.0
v3.4.0
v3.40.0
v3.41.0
v3.42.0
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50273.json"