CVE-2026-50275: Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote unauthenticated client can send an arbitrarily large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate hash-map entries and consume unbounded CPU and memory on each request. Baggage extraction is enabled by default in most affected deployments unless baggage is removed from DDTRACEPROPAGATIONSTYLE or DDTRACEPROPAGATIONSTYLEEXTRACT. This issue is fixed in version 1.19.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Datadog PHP Tracerto a version that resolves this vulnerability.Fixed in 1.19.2 - Configuration
Remove/disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT (baggage extraction is enabled by default in most affected deployments).
Datadog PHP Tracer DD_TRACE_PROPAGATION_STYLE_EXTRACT = remove baggage from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT - Configuration
Ensure ddtrace_deserialize_baggage enforces DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES (not enforced prior to 1.19.2).
Datadog PHP Tracer DD_TRACE_BAGGAGE_MAX_ITEMS / DD_TRACE_BAGGAGE_MAX_BYTES = enforce limits
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Affected deployments using Datadog PHP Tracer before 1.19.2 are generally exposed because baggage extraction is enabled by default in most configurations. Deployments that remove baggage from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT are not described as having baggage extraction enabled.
What does an attacker need to exploit this issue?
An attacker only needs network access to send HTTP requests containing W3C baggage headers; no authentication or user interaction is required. The attacker can use many comma-separated key-value pairs or one oversized baggage value to drive CPU and memory consumption on each request.
What can be done if upgrading is not immediately possible?
Remove baggage from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT to disable baggage extraction. This mitigates exposure to malicious incoming W3C baggage headers until the tracer can be updated.
How can I determine whether an installation is affected?
Check whether the Datadog PHP Tracer version is earlier than 1.19.2 and whether baggage remains enabled in the extraction propagation configuration. The issue is fixed in version 1.19.2.