Description

dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T20:18:17.950Z",
  "pubdate": "2026-08-28T20:18:17.950Z",
  "executiveSummary": "The dd-trace-rs library is susceptible to a Denial of Service (DoS) vulnerability originating from improper input validation during the parsing of W3C tracestate headers.\nSpecifically, the datadog-opentelemetry component fails to enforce size or count constraints on key-value pairs embedded within the dd= vendor entry of the tracestate header.\nThis flaw allows a remote, unauthenticated attacker to inject arbitrarily large payloads into instrumented network services.\nThe ingestion of these oversized headers results in unbounded memory allocation and excessive CPU cycles during HashMap population, which can lead to service instability, latency spikes, or complete process termination due to resource exhaustion.\nBecause tracecontext extraction is enabled by default in affected versions, the attack surface is significant for any service leveraging this library. The vulnerability affects versions 0.1.0 through 0.3.3.",
  "technicalDetails": "The vulnerability resides within the implementation of the tracecontext parser located in datadog-opentelemetry/src/propagation/tracecontext.rs. The root cause is the lack of strict validation regarding the cardinality and length of data parsed from the W3C tracestate header.\nWhen a service receives an incoming request containing a W3C tracestate header, the library attempts to extract the dd= entry. The parser iterates through the semicolon-separated segments within this vendor entry. Crucially, the implementation populates a standard Rust HashMap with these segments without imposing a limit on the number of pairs or the byte size of each key and value.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts a malicious HTTP request featuring a crafted tracestate header. 2) This header contains an abnormally large dd= string populated with a high density of key-value pairs. 3) The target application's instrumented endpoint receives the request, triggering the dd-trace-rs library to invoke the vulnerable parsing logic. 4) The parser aggressively allocates memory to accommodate the HashMap structure and the storage of the oversized input strings. 5) Simultaneously, the CPU processes the parsing logic to populate the map. 6) The cumulative resource demand—spanning both memory pressure from allocation and CPU consumption from string manipulation—exhausts system resources, leading to a Denial of Service (DoS).\nThis mechanism is particularly dangerous because it bypasses application-layer request size limits that might be configured elsewhere, as the processing occurs during the instrumentation's extraction phase. The vulnerability is present in versions 0.1.0 up to 0.3.3. Successful exploitation does not require prior authentication or elevated privileges; it is entirely network-exposed as long as the service utilizes the default tracecontext extraction feature. Post-exploitation impact manifests as service unavailability, potentially affecting the availability of downstream systems reliant on the instrumented service."
}