Datadog's dd-trace-go library versions prior to 2.8.1 do not enforce item-count or byte-size limits on incoming W3C baggage headers during extraction, although such limits exist for injection. An attacker can exploit this by sending a request with a baggage header containing an arbitrarily large number of comma-separated key-value pairs or a single very large value. Each pair causes the tracer to allocate a hash-map entry, leading to unbounded CPU and memory consumption and enabling remote denial of service. The baggage propagation style is enabled by default in most affected tracers, exposing internet-facing services instrumented with these versions unless explicitly restricted.

A remote, unauthenticated attacker can cause a denial of service by sending specially crafted HTTP requests with large or numerous baggage header items. This leads to excessive CPU and memory consumption in the dd-trace-go tracer, potentially degrading or crashing the instrumented HTTP service. There is no impact on confidentiality or integrity, only availability.

A fix is available in dd-trace-go version 2.8.1 and later; upgrading to this version or newer fully resolves the issue. If immediate upgrade is not possible, users should disable baggage extraction by removing 'baggage' from the DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT environment variables. Additionally, capping the maximum HTTP request header size at an upstream proxy or web server (e.g., Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb) can mitigate the risk.