CyberRota Analysis
AI-GeneratedThe Datadog PHP Tracer prior to version 1.19.2 is vulnerable to a denial-of-service attack due to improper handling of W3C baggage HTTP headers, allowing remote unauthenticated clients to exploit this by sending excessive key-value pairs or oversized values. This can lead to unbounded CPU and memory consumption, potentially impacting application performance and stability. Organizations using affected versions of the Datadog PHP Tracer should prioritize upgrading to version 1.19.2 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send an arbitrarily large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate hash-map entries and consume unbounded CPU and memory on each request. Baggage extraction is enabled by default in most affected deployments unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT. This issue is fixed in version 1.19.2.