datadog-lambda (>=2.27.0, <=3.31.0) potentially affected by CVE-2026-50271 via ddtrace (0.45.0)

ddtrace PYPI version 0.45.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =2.27.0, =3.31.0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

opentelemetry-exporter-datadog (>=0.20.0b0, <=0.30.0b0) potentially affected by CVE-2026-50271 via ddtrace (0.46.0)

ddtrace PYPI version 0.46.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - opentelemetry-exporter-datadog =0.20.0b0, =0.30.0b0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-lambda (>=3.33.0, <=3.41.0) potentially affected by CVE-2026-50271 via ddtrace (0.48.0)

ddtrace PYPI version 0.48.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.33.0, =3.41.0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-lambda (3.49.0) potentially affected by CVE-2026-50271 via ddtrace (0.53.0)

ddtrace PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda 3.49.0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-checks-base (>=25.0.0, <=32.5.1) potentially affected by CVE-2026-50271 via ddtrace (0.53.2)

ddtrace PYPI version 0.53.2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-checks-base =25.0.0, =32.5.1 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-lambda (>=3.50.0, <=3.51.0) potentially affected by CVE-2026-50271 via ddtrace (0.55.4)

ddtrace PYPI version 0.55.4 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.50.0, =3.51.0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-lambda (>=3.52.0, <=3.53.0), spellbot (7.12.3) potentially affected by CVE-2026-50271 via ddtrace (0.58.5)

ddtrace PYPI version 0.58.5 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.52.0, =3.53.0 - spellbot 7.12.3 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-lambda (>=3.54.0, <=3.58.0), dh-potluck (1.4.0) +1 more potentially affected by CVE-2026-50271 via ddtrace (0.59.2)

ddtrace PYPI version 0.59.2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.54.0, =3.58.0 - dh-potluck 1.4.0 - spellbot 7.12.4 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-lambda (>=3.59.0, <=3.60.0) potentially affected by CVE-2026-50271 via ddtrace (0.61.5)

ddtrace PYPI version 0.61.5 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.59.0, =3.60.0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

opentelemetry-exporter-datadog (>=0.12.0b0, <=0.18.0b1) potentially affected by CVE-2026-50271 via ddtrace (1.10.3)

ddtrace PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - opentelemetry-exporter-datadog =0.12.0b0, =0.18.0b1 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-lambda (>=4.77.0, <=4.80.0) potentially affected by CVE-2026-50271 via ddtrace (1.15.2)

ddtrace PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =4.77.0, =4.80.0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-lambda (>=4.81.0, <=4.82.0) potentially affected by CVE-2026-50271 via ddtrace (2.0.0rc2)

ddtrace PYPI version 2.0.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =4.81.0, =4.82.0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

datadog-lambda (>=8.118.0, <=8.120.0) potentially affected by CVE-2026-50271 via ddtrace (3.18.1)

ddtrace PYPI version 3.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =8.118.0, =8.120.0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parseBaggageHeaders extraction path in dd-trace-core/src/main/java/datadog/trace/core/baggage/BaggagePropagator.java. An attacker can exhaust CPU and memory by sending a...

PT-2026-60362

Name of the Vulnerable Software and Affected Versions Datadog .NET Tracer versions prior to 3.43.0 Description Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing limits on the number of items or the total byte size during...

PT-2026-60360

Name of the Vulnerable Software and Affected Versions dd-trace-py versions prior to 4.8.2 Description Datadog tracing libraries implementing W3C baggage propagation fail to enforce limits on the number of items or total bytes when parsing incoming baggage HTTP headers during the extraction proces...

PT-2026-60359

Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD TRACE BAGGAGE MAX ITEMS default 64 and DD TRACE BAGGAGE MAX BYTES default 8192 limits were applied only to bagga...

PT-2026-60361

Name of the Vulnerable Software and Affected Versions dd-trace versions prior to 5.100.0 Description An issue exists in the W3C baggage propagation within packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text map.js where incoming baggage HTTP headers are parsed...

PT-2026-60364

Name of the Vulnerable Software and Affected Versions dd-trace-rb versions prior to 2.32.0 Description An issue exists in the W3C baggage extraction process where the library fails to enforce limits on the number of items or the total byte size of the baggage HTTP header. While limits are applied...

PT-2026-60363

Name of the Vulnerable Software and Affected Versions dd-trace-go versions prior to 2.8.1 Description Datadog tracing libraries implementing W3C baggage propagation fail to enforce limits on the number of items or total bytes when parsing incoming baggage HTTP headers during the extraction proces...