The dd-trace-java library improperly handles W3C baggage headers by not enforcing the configured maximum item count and byte size limits during baggage extraction, only during injection. This flaw allows an attacker to craft HTTP requests with baggage headers containing an arbitrarily large number of key-value pairs or very large values. Each pair results in a hash-map allocation on every request, leading to unbounded resource consumption and enabling remote denial of service attacks on services using the affected tracer versions with baggage propagation enabled. The vulnerability affects versions prior to 1.62.0 and is fixed in 1.62.0 and later.

A remote unauthenticated attacker can cause a denial of service by sending specially crafted HTTP requests with large or numerous baggage header items, leading to excessive CPU and memory usage on the affected service. This impacts availability but does not affect confidentiality or integrity.

A fix is available in dd-trace-java version 1.62.0 and later; upgrading to these versions remediates the vulnerability. If immediate upgrade is not possible, users should disable baggage extraction by removing 'baggage' from the DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT environment variables. Additionally, capping the maximum HTTP request header size at upstream proxies or web servers (e.g., Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb) can mitigate exploitation.