In dd-trace-java versions prior to 1.62.0 the library does not enforce the maximum number of baggage items or maximum baggage bytes when extracting W3C baggage headers. An unauthenticated attacker can send an HTTP header containing many comma-separated key‑value pairs or a single very large value. The extraction code allocates map entries for each pair while parsing the attacker‑controlled header on every request. This can lead to unbounded CPU and memory consumption in an HTTP service that has baggage propagation enabled, resulting in a denial of service.

The vulnerability affects the Datadog APM Java client known as dd-trace-java or com.datadoghq:dd-java-agent in all releases before 1.62.0.

The CVSS score of 7.5 categorizes this flaw as high severity, and the EPSS score is not available, so the current exploitation likelihood is unknown. The attacker does not need authentication and only needs to send a crafted HTTP request to a service that uses the tracer, which is the default for most affected tracers. The KEV catalog does not list this vulnerability, but exposed services.