Datadog .NET Tracer is a client library that sends and receives tracing data for .NET applications. Prior to version 3.43.0, the library parsed incoming W3C baggage HTTP headers without enforcing the maximum item or byte limits defined by DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. This omission allows an unauthenticated remote attacker to supply a header containing a large number of comma‑separated key‑value pairs or a single very large value, causing the tracer to consume unbounded CPU and memory during parsing. The result is that any .NET service with baggage propagation enabled can suffer a denial of service. The vendor addressed the issue in release 3.43.0.

The issue affects the DataDog dd‑trace‑dotnet library in all versions prior to 3.43.0 when baggage propagation is configured. Any .NET application that employs this tracer with baggage enabled is at risk.

The CVSS score of 7.5 classifies the issue as high severity, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. A remote unauthenticated attacker can trigger the exploit by sending a crafted HTTP request containing a large baggage header, a path that is inferred from the description as the most likely attack vector.