CyberRota Analysis
AI-GeneratedThe Datadog dd-trace-go library prior to version 2.8.1 is vulnerable to a denial of service attack due to improper handling of W3C baggage HTTP headers, allowing remote, unauthenticated attackers to exploit unbounded CPU and memory consumption. Organizations utilizing this library for application performance monitoring should prioritize upgrading to version 2.8.1 to mitigate the risk of service disruption. This vulnerability poses a significant threat to any HTTP services that have baggage propagation enabled.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.