CVE-2026-50275
highThe Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP.
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send an arbitrarily large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate hash-map entries and consume unbounded CPU and memory on each request. Baggage extraction is enabled by default in most affected deployments unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT. This issue is fixed in version 1.19.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/DataDog/dd-trace-php/commit/2f7987eb02e306bb62bce8ec4152dece68112f51 security-advisories@github.com
- https://github.com/DataDog/dd-trace-php/commit/43072ccafe55a5dbdfba75a42bf316b4150ae1e5 security-advisories@github.com
- https://github.com/DataDog/dd-trace-php/pull/3854 security-advisories@github.com
- https://github.com/DataDog/dd-trace-php/releases/tag/1.19.2 security-advisories@github.com
- https://github.com/DataDog/dd-trace-php/releases/tag/1.20.0 security-advisories@github.com
- https://github.com/DataDog/dd-trace-php/security/advisories/GHSA-phwx-ww2p-cv9v security-advisories@github.com