Vulnerability Description
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71d0ea8103da0e6cf4cd50677
- https://github.com/DataDog/dd-trace-rs/pull/218
- https://github.com/DataDog/dd-trace-rs/releases/tag/datadog-opentelemetry-v0.3.3
- https://github.com/DataDog/dd-trace-rs/security/advisories/GHSA-gpwf-4h98-v82q
FAQ
What is CVE-2026-54788?
CVE-2026-54788 is a vulnerability with a CVSS score of 7.5 (HIGH). dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects ev...
How severe is CVE-2026-54788?
CVE-2026-54788 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54788?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.