GHSA-GPWF-4H98-V82Q datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

Impact Datadog tracing libraries that implement W3C Trace Context tracecontext propagation parse the incoming tracestate header without enforcing a size cap on the Datadog vendor entry dd=.... The dd= value contains semicolon-separated key:value pairs, and the parser allocates a hash-map entry fo...

datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

Impact Datadog tracing libraries that implement W3C Trace Context tracecontext propagation parse the incoming tracestate header without enforcing a size cap on the Datadog vendor entry dd=.... The dd= value contains semicolon-separated key:value pairs, and the parser allocates a hash-map entry fo...

CVE-2026-54788 dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS

dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap...

CVE-2026-54788

dd-trace-rs (Datadog APM for Rust), versions 0.1.0 through 0.3.3, is affected by an unbounded W3C tracestate parsing flaw in datadog-opentelemetry/src/propagation/tracecontext.rs. The parser collects every semicolon-separated key:value pair in the Datadog dd=... vendor entry into a HashMap withou...