Ddtrace: dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS (CVE-2026-50271)
The dd-trace-py library versions prior to 4.8.2 contain a vulnerability in the parsing of W3C baggage HTTP headers. The library does not enforce limits on the number or size of baggage items during extraction, allowing remote unauthenticated attackers to send requests with excessively large or numerous baggage items. This can cause unbounded CPU and memory consumption, resulting in a remote denial of service (DoS) against HTTP services using the affected tracer with baggage propagation enabled by default.
AI Analysis
Technical Summary
The dd-trace-py library before version 4.8.2 improperly parses W3C baggage HTTP headers by failing to enforce limits on the number and size of baggage items during extraction. This flaw allows remote unauthenticated attackers to craft requests with large or numerous baggage items, leading to excessive CPU and memory usage. The consequence is a remote denial of service (DoS) condition against HTTP services that use the affected dd-trace-py tracer with baggage propagation enabled. The vulnerability is tracked as CVE-2026-50271 and is associated with CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-400 (Uncontrolled Resource Consumption).
Potential Impact
Exploitation of this vulnerability results in a remote denial of service (DoS) due to unbounded CPU and memory consumption caused by improper parsing of W3C baggage headers. There is no impact on confidentiality or integrity, but availability of the affected HTTP services is severely impacted.
Mitigation Recommendations
A fix is available in dd-trace-py version 4.8.2. Users should upgrade to version 4.8.2 or later to address this vulnerability. No other mitigation or temporary workaround is indicated in the provided data.
Ddtrace: dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS (CVE-2026-50271)
Description
The dd-trace-py library versions prior to 4.8.2 contain a vulnerability in the parsing of W3C baggage HTTP headers. The library does not enforce limits on the number or size of baggage items during extraction, allowing remote unauthenticated attackers to send requests with excessively large or numerous baggage items. This can cause unbounded CPU and memory consumption, resulting in a remote denial of service (DoS) against HTTP services using the affected tracer with baggage propagation enabled by default.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The dd-trace-py library before version 4.8.2 improperly parses W3C baggage HTTP headers by failing to enforce limits on the number and size of baggage items during extraction. This flaw allows remote unauthenticated attackers to craft requests with large or numerous baggage items, leading to excessive CPU and memory usage. The consequence is a remote denial of service (DoS) condition against HTTP services that use the affected dd-trace-py tracer with baggage propagation enabled. The vulnerability is tracked as CVE-2026-50271 and is associated with CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-400 (Uncontrolled Resource Consumption).
Potential Impact
Exploitation of this vulnerability results in a remote denial of service (DoS) due to unbounded CPU and memory consumption caused by improper parsing of W3C baggage headers. There is no impact on confidentiality or integrity, but availability of the affected HTTP services is severely impacted.
Mitigation Recommendations
A fix is available in dd-trace-py version 4.8.2. Users should upgrade to version 4.8.2 or later to address this vulnerability. No other mitigation or temporary workaround is indicated in the provided data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mw54-j2v2-42hr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-50271"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a58b40468715ace43d67060
Added to database: 07/16/2026, 10:35:48 UTC
Last enriched: 07/24/2026, 21:00:10 UTC
Last updated: 09/01/2026, 10:52:09 UTC
Views: 113
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.