The dd-trace-go library, a Go client for Datadog monitoring, was vulnerable before version 2.8.1. It parsed incoming W3C baggage headers without enforcing the DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits in the extraction path. An attacker could send a request whose baggage header contained an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing the library to consume unbounded CPU cycles and memory. This led to a remote denial of service against any HTTP service that processes baggage propagation. The issue was fixed in version 2.8.1.

The DataDog client library, versions prior to 2.8.1, is affected. The library is used for application performance monitoring, profiling, and security monitoring.

The vulnerability carries a CVSS score of 7.5 and an EPSS score of < 1%. It is not listed in CISA KEV. A remote, unauthenticated attacker can exploit the issue by sending a crafted HTTP request with a large baggage header. While the exploit requires network access to a service that integrates dd-trace-go, the lack of input validation makes it easy to trigger, resulting in high CPU and memory consumption.