CVE-2026-50270

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0.

• CWE-770

• https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757
• https://github.com/DataDog/dd-trace-java/pull/11265
• https://github.com/DataDog/dd-trace-java/releases/tag/v1.62.0
• https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-74xj-wh4w-vqxc

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50265Rejected reason: This CVE ID was assigned as a duplicate of …
• CVE-2026-50266In OpenStack Neutron before 28.0.1, a project manager can cr…2.2
• CVE-2026-50267Steeltoe is an open source project that provides a collectio…4.7
• CVE-2026-50268Steeltoe is an open source project that provides a collectio…1.9
• CVE-2026-50269AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2026-5027The 'POST /api/v2/files' endpoint does not sanitize the 'fil…8.8
• CVE-2026-50271Datadog dd-trace-py is the Datadog Python APM client. Prior …7.5
• CVE-2026-50272dd-trace is the Datadog APM client for Node.js. Prior to 5.1…7.5
• CVE-2026-50273Datadog .NET Tracer is a client library for Datadog APM for …7.5
• CVE-2026-50274Datadog dd-trace-go is a Go client library for Datadog appli…7.5
• CVE-2026-50275The Datadog PHP Tracer provides application performance moni…7.5
• CVE-2026-50276dd-trace-rb is Datadog's client library for Ruby. Prior to 2…7.5