Allocation of Resources Without Limits or Throttling Affecting com.datadoghq:dd-java-agent package, versions [,1.62.0)

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parseBaggageHeaders extraction path in dd-trace-core/src/main/java/datadog/trace/core/baggage/BaggagePropagator.java. An attacker can exhaust CPU and memory by sending a request with a W3C baggage header containing an arbitrarily large number of comma-separated key-value pairs or a single very large value. The extractor parses inbound baggage without enforcing the configured item-count or byte-size limits on the extract path, so each request can allocate and process unbounded map entries. Services instrumented with affected Datadog tracing libraries and baggage propagation enabled can become slow or unresponsive under repeated malicious requests.

Notes

• The vulnerable path is only exercised when W3C baggage propagation is enabled in the tracer’s propagation style; the advisory’s limits are DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES, but they were enforced on injection rather than inbound header parsing.
• The maintainer advisory says the default propagation style includes baggage in most affected tracers, so internet-facing instrumented services can be exposed without any special opt-in beyond the standard tracer configuration.

Workarounds

• Disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE, or from DD_TRACE_PROPAGATION_STYLE_EXTRACT if that setting is configured separately; this prevents the tracer from parsing inbound W3C baggage headers and blocks the remote DoS path.
• Cap the maximum HTTP request header size at an upstream proxy or web server, for example with Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb; this limits oversized baggage headers before they reach the tracer and reduces the attack surface.

• GitHub Commit
• Maintainer's Advisory