CyberRota Analysis
AI-GeneratedDatadog .NET Tracer versions prior to 3.43.0 are vulnerable to unbounded CPU and memory consumption due to improper parsing of incoming baggage HTTP headers, which can be exploited by remote unauthenticated attackers. This vulnerability allows attackers to send excessive key-value pairs or large values, potentially leading to service disruption. Organizations using Datadog APM for .NET applications should prioritize upgrading to version 3.43.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0.