Datadog dd-trace-py is a Python APM client that parses incoming W3C baggage headers. Until version 4.8.2 it did not enforce DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path, allowing an unauthenticated attacker to send a request with an arbitrarily large number of comma‑separated key‑value pairs or a single very large value. This causes unbounded CPU and memory consumption within the tracing library and can lead to a remote denial of service of any HTTP service that uses baggage propagation. The weakness is a classic example of CWE‑770.

Any application that uses the Datadog dd-trace-py library version 4.8.1 or earlier with W3C baggage propagation enabled is vulnerable. This includes custom Python services that import dd-trace-py, as well as any frameworks that automatically integrate the library. The fix is contained in dd-trace-py version 4.8.2 and later.

The CVSS score is 7.5, indicating a high likelihood of significant impact if exploited. The EPSS score of less than 1% shows a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a remotely triggered HTTP request, requiring no authentication and not limited to a specific environment. The risk is mitigated primarily by upgrading to a patched version or applying additional controls to limit baggage header size.