Datadog's dd-trace-py library before version 4.8.2 does not enforce item-count or byte-size limits on incoming W3C baggage HTTP headers during extraction, although such limits exist for injection. An attacker can exploit this by sending requests with arbitrarily large numbers of comma-separated key-value pairs or very large values in the baggage header. Each pair causes the tracer to allocate a hash-map entry, resulting in unbounded resource consumption and enabling a remote denial of service. The vulnerability affects any internet-facing service instrumented with the affected tracer version and using the default baggage propagation style.

A remote, unauthenticated attacker can cause a denial of service by exhausting CPU and memory resources of the affected service through specially crafted HTTP requests with large or numerous baggage header items. There is no impact on confidentiality or integrity, only availability is affected.

A fix is available in dd-trace-py version 4.8.2 and later; upgrading to these versions resolves the issue. If immediate upgrade is not possible, users should disable baggage extraction by removing 'baggage' from the DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT environment variables. Additionally, capping the maximum HTTP request header size at an upstream proxy or web server (e.g., Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb) can mitigate the risk.