CVE-2026-106450 vulnerabilities

Vulnerabilities for packages: datahub-gms, apache-nifi, hadoop-fips, cassandra-fips, elasticsearch-fips, opensearch-fips, automq, akhq, datahub-frontend, seata, metabase, knative-kafka-broker, apicurio-registry-fips, solr, cruise-control-fips, datahub-gms-fips, kayenta-fips, solr-fips, pinot-fips...

GHSA-GM45-99XC-R7WV vulnerabilities

Vulnerabilities for packages: datahub-gms, apache-nifi, hadoop-fips, cassandra-fips, elasticsearch-fips, opensearch-fips, automq, akhq, datahub-frontend, seata, metabase, knative-kafka-broker, apicurio-registry-fips, solr, cruise-control-fips, datahub-gms-fips, kayenta-fips, solr-fips, pinot-fips...

GHSA-343H-94H5-C4WR vulnerabilities

Vulnerabilities for packages: datahub-gms, apache-nifi, hadoop-fips, cassandra-fips, elasticsearch-fips, opensearch-fips, automq, akhq, datahub-frontend, seata, metabase, knative-kafka-broker, apicurio-registry-fips, solr, cruise-control-fips, datahub-gms-fips, kayenta-fips, solr-fips, pinot-fips...

CVE-2026-50277

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50277

dd-trace-cpp (Datadog's C++ distributed tracing library) prior to 2.1.0 parses incoming W3C baggage headers on the extraction path without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits, even though those limits are applied during injection. A remote unauthenticated att...

CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

EUVD-2026-82423

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

PT-2026-95087

Name of the Vulnerable Software and Affected Versions dd-trace-cpp versions prior to 2.1.0 Description The library parses incoming W3C baggage headers without enforcing the DD TRACE BAGGAGE MAX ITEMS or DD TRACE BAGGAGE MAX BYTES limits during the extraction path. A remote unauthenticated attacke...

CVE-2026-50277: Allocation of Resources Without Limits or Throttling

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

ROOT-APP-NPM-CVE-2026-50272 CVE-2026-50272 in dd-trace - Patched by Root

Root has patched CVE-2026-50272 in the dd-trace package for Root:npm. Multiple fixed versions available...

CVE-2026-50276

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...

CVE-2026-50270

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50276 dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...

EUVD-2026-77671

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...

CVE-2026-50276

dd-trace-rb (Datadog's Ruby tracing library) is affected by a remote Denial of Service vulnerability (CVSS 7.5, HIGH) in its W3C baggage header extraction path. Prior to version 2.32.0 , the limits DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) were enforced...

CVE-2026-50276 dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...

CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...