dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...

GHSA-MW54-J2V2-42HR dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...

PT-2026-60364

Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD TRACE BAGGAGE MAX ITEMS default 64 and DD TRACE BAGGAGE MAX BYTES default 8192 limits were applied only to bagga...

PT-2026-60360

Name of the Vulnerable Software and Affected Versions dd-trace-py versions prior to 4.8.2 Description Datadog tracing libraries implementing W3C baggage propagation fail to enforce limits on the number of items or total bytes when parsing incoming baggage HTTP headers during the extraction proces...

PT-2026-60361

Name of the Vulnerable Software and Affected Versions dd-trace versions prior to 5.100.0 Description An issue exists in the W3C baggage propagation within packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text map.js where incoming baggage HTTP headers are parsed...

PT-2026-60363

Name of the Vulnerable Software and Affected Versions dd-trace-go versions prior to 2.8.1 Description Datadog tracing libraries implementing W3C baggage propagation fail to enforce limits on the number of items or total bytes when parsing incoming baggage HTTP headers during the extraction proces...

PT-2026-60362

Name of the Vulnerable Software and Affected Versions Datadog .NET Tracer versions prior to 3.43.0 Description Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing limits on the number of items or the total byte size during...

CVE-2026-49476 vulnerabilities

Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, datadog-agent, datadog-agent-fips...

GHSA-2WC2-FM75-P42X vulnerabilities

Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, datadog-agent, datadog-agent-fips...

CVE-2026-49476 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, datadog-agent, open-webui...

GHSA-2WC2-FM75-P42X vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, datadog-agent, open-webui...

GHSA-836R-79RF-4M37 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, datadog-agent, open-webui...

CVE-2026-49477 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, datadog-agent, open-webui...

GHSA-836R-79RF-4M37 vulnerabilities

Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, datadog-agent, datadog-agent-fips...

CVE-2026-49477 vulnerabilities

Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, datadog-agent, datadog-agent-fips...

CVE-2026-57522

Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens, which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template referenc...

EUVD-2026-39543

Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens, which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template referenc...

PT-2026-52576

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.5.0 Description An issue exists in the IntegrationTemplateProcessor.ReplaceTokens function where user-controlled values are substituted into event-integration templates without proper JSON encoding. An...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: aws-fsx-csi-driver, kubernetes-csi-external-snapshotter, crossplane-provider-aws-osis-fips, kubevirt-cdi-uploadserver, beats-fips, dgraph, crossplane-function-patch-and-transform-fips, kgateway-fips, kubernetes-dns-node-cache-fips, external-secrets-operator,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: aws-fsx-csi-driver, kubernetes-csi-external-snapshotter, crossplane-provider-aws-osis-fips, kubevirt-cdi-uploadserver, beats-fips, dgraph, crossplane-function-patch-and-transform-fips, kgateway-fips, kubernetes-dns-node-cache-fips, external-secrets-operator,...