CVE-2026-50275 DataDog CVE debrief

Who should care

Defenders responsible for PHP applications using the Datadog PHP Tracer should assess exposure and consider upgrading to version 1.19.2 or later. This includes reviewing if the tracer's baggage extraction feature is enabled and monitoring for potential denial-of-service attacks.

Why it matters

CVE-2026-50275 is a denial-of-service vulnerability in the Datadog PHP Tracer that allows an attacker to consume unbounded CPU and memory. Defenders should prioritize verifying exposure and upgrading to version 1.19.2 or later.

• Potential denial-of-service attacks through CPU and memory consumption
• Verification of exposure and upgrade to version 1.19.2 or later is necessary

Technical summary

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. This allows a remote unauthenticated client to send an arbitrarily large number of comma-separated key-value pairs or a single oversized value, causing the tracer to allocate hash-map entries and consume unbounded CPU and memory on each request.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 1.19.2 or later, as this issue allows for potential denial-of-service attacks.

Recommended defensive actions

• Verify if the Datadog PHP Tracer is in use and if the version is prior to 1.19.2
• Assess if the tracer's baggage extraction feature is enabled
• Consider upgrading to version 1.19.2 or later
• Monitor for potential denial-of-service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the issue, but do not specify any instances of exploitation or specific impacts. The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. There is no evidence of exploitation in the wild, but defenders should verify if the Dat

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.