CVE-2026-50275
Description
A flaw was found in Datadog PHP Tracer. Improper parsing of W3C baggage HTTP headers allows a remote unauthenticated client to send an arbitrarily large number of key-value pairs or an oversized value. This causes the tracer to consume unbounded CPU and memory on each request, leading to a Denial of Service (DoS).
Statement
This vulnerability is rated as an Important impact because a remote, unauthenticated attacker can exhaust server compute and memory allocations, resulting in a denial-of-service condition without needing special privileges or interaction. Red Hat Enterprise Linux does not package the Datadog PHP Tracer, though PHP applications running in containers or on virtual instances that integrate this third-party monitoring extension remain exposed. Because baggage extraction is enabled under default tracing configurations, affected web services will process untrusted headers automatically, though overall system integrity and confidentiality remain intact.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
