datadog-lambda (3.49.0) potentially affected by CVE-2026-50271 via ddtrace (0.53.0)

ddtrace PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda 3.49.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-checks-base (>=25.0.0, <=32.5.1) potentially affected by CVE-2026-50271 via ddtrace (0.53.2)

ddtrace PYPI version 0.53.2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-checks-base =25.0.0, =32.5.1 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=3.50.0, <=3.51.0) potentially affected by CVE-2026-50271 via ddtrace (0.55.4)

ddtrace PYPI version 0.55.4 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.50.0, =3.51.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=3.52.0, <=3.53.0), spellbot (7.12.3) potentially affected by CVE-2026-50271 via ddtrace (0.58.5)

ddtrace PYPI version 0.58.5 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.52.0, =3.53.0 - spellbot 7.12.3 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=3.54.0, <=3.58.0), dh-potluck (1.4.0) +1 more potentially affected by CVE-2026-50271 via ddtrace (0.59.2)

ddtrace PYPI version 0.59.2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.54.0, =3.58.0 - dh-potluck 1.4.0 - spellbot 7.12.4 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=3.59.0, <=3.60.0) potentially affected by CVE-2026-50271 via ddtrace (0.61.5)

ddtrace PYPI version 0.61.5 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.59.0, =3.60.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

opentelemetry-exporter-datadog (>=0.12.0b0, <=0.18.0b1) potentially affected by CVE-2026-50271 via ddtrace (1.10.3)

ddtrace PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - opentelemetry-exporter-datadog =0.12.0b0, =0.18.0b1 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=4.77.0, <=4.80.0) potentially affected by CVE-2026-50271 via ddtrace (1.15.2)

ddtrace PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =4.77.0, =4.80.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=4.81.0, <=4.82.0) potentially affected by CVE-2026-50271 via ddtrace (2.0.0rc2)

ddtrace PYPI version 2.0.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =4.81.0, =4.82.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=8.118.0, <=8.120.0) potentially affected by CVE-2026-50271 via ddtrace (3.18.1)

ddtrace PYPI version 3.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =8.118.0, =8.120.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

PYSEC-2026-3461 dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...

PT-2026-64073

Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD TRACE BAGGAGE MAX ITEMS default 64 and DD TRACE BAGGAGE MAX BYTES default 8192 limits were applied only to bagga...

GHSA-MW54-J2V2-42HR vulnerabilities

Vulnerabilities for packages: datadog-agent...

CVE-2026-50271 vulnerabilities

Vulnerabilities for packages: datadog-agent...

CVE-2026-50271 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, litellm, datadog-agent...

GHSA-MW54-J2V2-42HR vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, litellm, datadog-agent...

CVE-2026-50274

A flaw was found in Datadog dd-trace-go, a Go client library. A remote, unauthenticated attacker can exploit this vulnerability by sending a request with a specially crafted baggage header containing an arbitrarily large number of key-value pairs or a very large single value. This can lead to...

CVE-2026-50271

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES limits on the extract path. A remote, unauthenticated...

CVE-2026-50272

dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/textmap.js parsed incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on...

CVE-2026-50274

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or...