Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| DataDog | dd-trace-rs | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-gpwf-4h98-v82q | datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS |
Fri, 28 Aug 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3. | |
| Title | dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS | |
| Weaknesses | CWE-770 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-08-28T16:33:49.032Z
Reserved: 2026-06-15T23:23:57.714Z
Link: CVE-2026-54788
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-28T20:18:17.950
Modified: 2026-08-28T20:18:17.950
Link: CVE-2026-54788
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-770
Allocation of Resources Without Limits or Throttling