CVE-2026-50271

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50271
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-50271.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-50271
Aliases
Downstream
CGA (45)
CLEANSTART (5)
ECHO (1)
MINI (16)
ROOT (1)
Published
2026-07-17T20:42:34Z
Modified
2026-10-26T02:34:48Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
Details

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 4.8.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50271.json"
}
References

Affected packages

Git / github.com/datadog/dd-trace-py

Affected ranges

Type
GIT
Repo
https://github.com/datadog/dd-trace-py
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
58d0fd22d5d203637283843f8450bcdf64959fec
Fixed
9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.8.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "9c80faa3dcfe238d008c3b3cd0b8e5dfef0aa4cd"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v4.8.2",
            "range": [
                {
                    "fixed": "58d0fd22d5d203637283843f8450bcdf64959fec"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.3.14
v0.*
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.13.0
v0.13.1
v0.14.0
v0.14.1
v0.15.0
v0.16.0
v0.17.0
v0.17.1
v0.18.0
v0.19.0
v0.20.0
v0.20.1
v0.20.2
v0.20.3
v0.20.4
v0.21.0
v0.21.1
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.3.0
v0.3.1
v0.3.10
v0.3.11
v0.3.12
v0.3.13
v0.3.14
v0.3.15
v0.3.16
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.30.0
v0.31.0
v0.33.0
v0.34.0
v0.35.0
v0.36.0
v0.37.0
v0.38.0
v0.4.0
v0.41.0
v0.42.0rc1
v0.43.0
v0.43.0rc1
v0.44.0
v0.44.0rc1
v0.45.0rc1
v0.46.0rc1
v0.47.0rc1
v0.48.0rc1
v0.48.0rc2
v0.49.0rc1
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.50.0rc1
v0.50.0rc2
v0.50.0rc3
v0.50.0rc4
v0.50.0rc5
v0.51.0rc1
v0.51.0rc2
v0.52.0rc1
v0.53.0rc1
v0.54.0rc1
v0.55.0rc1
v0.56.0rc1
v0.56.0rc2
v0.56.0rc3
v0.57.0
v0.57.0rc1
v0.57.0rc2
v0.57.0rc3
v0.58.0rc1
v0.59.0rc1
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.9.0
v0.9.1
v0.9.2
v1.*
v1.1.0rc1
v1.10.0rc1
v1.10.0rc2
v1.11.0
v1.11.0rc1
v1.12.0
v1.12.0rc1
v1.13.0rc1
v1.14.0rc1
v1.15.0rc1
v1.16.0rc1
v1.17.0rc1
v1.18.0rc1
v1.19.0rc1
v1.2.0rc1
v1.20.0
v1.20.0rc1
v1.3.0rc1
v1.4.0rc1
v1.5.0rc1
v1.6.0rc1
v1.7.0rc1
v1.8.0rc1
v1.9.0rc1
v1.9.0rc2
v1.9.1
v2.*
v2.0.0rc1
v2.10.0rc1
v2.10.0rc2
v2.11.0rc1
v2.12.0rc1
v2.13.0rc1
v2.14.0
v2.14.0rc1
v2.15.0rc1
v2.16.0rc1
v2.17.0rc1
v2.18.0rc1
v2.19.0rc1
v2.2.0.pre
v2.2.0rc1
v2.20.0
v2.20.0rc1
v2.3.0
v2.3.0rc1
v2.4.0rc1
v2.5.0rc1
v2.6.0
v2.7.0rc1
v2.8.0rc1
v2.9.0rc1
v3.*
v3.0.0rc1
v3.0.0rc2
v3.1.0
v3.1.0rc1
v3.10.0
v3.10.0rc1
v3.10.0rc2
v3.10.0rc3
v3.11.0
v3.11.0rc1
v3.11.0rc2
v3.11.0rc3
v3.12.0
v3.12.0rc1
v3.12.0rc2
v3.12.0rc3
v3.13.0rc1
v3.14.0
v3.14.0rc1
v3.14.0rc2
v3.15.0
v3.15.0rc1
v3.16.0
v3.16.0rc1
v3.16.0rc2
v3.17.0
v3.17.0rc1
v3.18.0
v3.18.0rc1
v3.18.0rc2
v3.2.0
v3.2.0rc1
v3.3.0rc1
v3.4.0rc1
v3.5.0
v3.5.0rc1
v3.5.1
v3.6.0
v3.6.0rc1
v3.7.0
v3.7.0rc1
v3.7.0rc2
v3.8.0rc1
v3.9.0
v3.9.0rc1
v3.9.0rc2
v4.*
v4.0.0rc1
v4.1.0rc1
v4.3.0rc1
v4.4.0rc1
v4.4.0rc2
v4.4.0rc3
v4.5.0rc1
v4.5.0rc2
v4.6.0rc1
v4.6.0rc2
v4.6.0rc3
v4.7.0rc1
v4.7.0rc2
v4.7.0rc3
v4.7.0rc4
v4.8.0
v4.8.0rc1
v4.8.0rc2
v4.8.0rc3
v4.8.0rc4
v4.8.0rc5
v4.8.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-50271.json"