CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603

In OpenTelemetry Python versions prior to 1.45.1 , the opentelemetry-api component is vulnerable to a Regular Expression Denial of Service (ReDoS) . Specifically, the TraceState.from_header function in opentelemetry/trace/span.py (accessed via TraceContextTextMapPropagator.extract) uses an unboun...

CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

EUVD-2026-108216

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-59323

A flaw was found in Micrometer Tracing's Brave bridge when using W3C baggage propagation. A remote attacker can exploit this by sending specially crafted requests with excessively large baggage headers. This can lead to unbounded memory allocation, causing high CPU usage, increased garbage...

[SECURITY] Fedora 45 Update: docbook5-schemas-5.1-19.fc45

Docbook 5.X is a complete rewrite of Docbook in RELAX NG and not compatible with previous Docbook versions. This package contains Relax NG , DTD and W3C schema for Docbook 5.X. Syntax of those schemas is XML-compliant and is developed by the OASIS consortium...

CVE-2026-50277

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50275

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50277

dd-trace-cpp (Datadog's C++ distributed tracing library) prior to 2.1.0 parses incoming W3C baggage headers on the extraction path without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits, even though those limits are applied during injection. A remote unauthenticated att...

CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

EUVD-2026-82423

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

EUVD-2026-82416

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50275

Datadog PHP Tracer prior to 1.19.2 contains a denial-of-service vulnerability in ddtrace_deserialize_baggage (ext/distributed_tracing_headers.c). The function parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES, allowing a remote una...

CVE-2026-50277: Allocation of Resources Without Limits or Throttling

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50275: Allocation of Resources Without Limits or Throttling

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...