The dd-trace-dotnet library versions before 3.43.0 do not enforce item-count or byte-size limits when extracting W3C baggage headers, although such limits exist for injection. An attacker can exploit this by sending a request with a very large number of comma-separated key-value pairs or a single very large value in the baggage header. The tracer allocates a hash-map entry for each pair, leading to unbounded resource consumption and enabling a remote denial of service. The baggage propagation style is enabled by default in most affected tracers, exposing internet-facing services instrumented with these versions unless explicitly narrowed. The issue is fixed in version 3.43.0 and later.

A remote unauthenticated attacker can cause a denial of service by sending specially crafted HTTP requests with large or numerous baggage header items. This leads to excessive CPU and memory usage in the tracer, potentially impacting the availability of the instrumented HTTP service. There is no impact on confidentiality or integrity reported.

Upgrade to dd-trace-dotnet version 3.43.0 or later, where this issue is resolved. If immediate upgrade is not possible, mitigate by disabling baggage extraction via configuration (removing 'baggage' from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT). Additionally, limit the maximum HTTP request header size at upstream proxies or web servers using settings such as Apache's LimitRequestFieldSize, Nginx's large_client_header_buffers, or Envoy's max_request_headers_kb.