The vulnerability in dd‑trace‑rs occurs when parsing the W3C tracestate header; the library stores every semicolon‑separated key/value pair from the Datadog dd=… vendor entry into a HashMap without limiting the number of pairs or the size of each entry. An attacker can send a request with an arbitrarily large dd=… header, causing the application to consume excessive CPU and memory on each request and ultimately resulting in denial of service. The likely attack vector is through a crafted HTTP request header, and no authentication is required.

DataDog's dd‑trace‑rs library, versions 0.1.0 through 0.3.3, is affected. The fix was released in version 0.3.3. Applications that instrument with dd‑trace‑rs within this version range are at risk if they accept external W3C tracestate headers.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can exploit this via an HTTP header, making it an external attack. The exploit requires only the ability to send HTTP requests to the instrumented service; no authentication or privileged access is needed.