CyberRota Analysis
AI-GeneratedThe vulnerability affects the dd-trace client for Node.js, which improperly handles W3C baggage HTTP headers, allowing remote, unauthenticated attackers to exploit this flaw. By sending requests with excessive key-value pairs or large values in the baggage header, attackers can trigger unbounded CPU and memory consumption, leading to a denial of service for any HTTP service utilizing baggage propagation. Organizations using versions prior to 5.100.0 should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0.