7.5

CVE-2026-50274: datadog dd-trace-go

CVSS: 7.5v3.1HighAwaiting analysis
AliasesCGA-23p8-5mrm-v6rxCGA-242v-f6m3-574fCGA-2597-8qvg-ch3j
Published 17-07-2026Last modified 20-07-2026
Open JSON

Vulnerability summary

CVE-2026-50274 is a high (CVSS 7.5) vulnerability in datadog dd-trace-go. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.6% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.79%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 4
OPENSUSE-SU-2026:21551-1SUSE-SU-2026:23216-1SUSE-SU-2026:23227-1CGA-5R9W-M4GR-GXC3

Timeline

  1. 17-07-2026
    PublishedVulnerability first disclosed.
  2. 20-07-2026
    Last modifiedVulnerability information updated.

Description

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.79%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

0.00 pp

From 0.79% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.79%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard40 products
  • buildkite-agent< 3.132.0-r1
  • buildkite-agent-fips< 3.133.0-r1
  • coder-2.29< 2.29.19-r1
  • coder-2.32< 2.32.10-r1
  • coder-2.33< 2.33.11-r3
Wolfi11 products
  • datadog-agent-7.79< 7.79.2-r15
  • datadog-agent-7.79-full< 7.79.2-r15
  • datadog-cluster-agent-7.79< 7.79.2-r15
  • datadog-operator< 1.31.0-r1
  • dogstatsd-7.79< 7.79.2-r15
Datadog1 product
Github.com/DataDog1 product
  • dd-trace-go≤ 1.24.1 | All versions (No fix recorded)
Github.com/DataDog/dd-trace-go1 product
  • v2< 2.8.1

5 vendors · 54 products

References

7 links