datadog-opentelemetry Package Vulnerability: What You Need to Know
- Severity
- HIGH
- Affected component
- datadog-opentelemetry (cargo)
- Affected versions
- >= 0.1.0, < 0.3.3
- Patched version
- 0.3.3
An early warning has been issued for a potential Denial of Service vulnerability in the datadog-opentelemetry package. This vulnerability may allow a remote, unauthenticated attacker to cause unbounded CPU and memory consumption.
What happened
The datadog-opentelemetry package, specifically versions 0.1.0 to 0.3.2, has an unbounded W3C tracestate parsing issue. This flaw allows a remote, unauthenticated attacker to force excessive CPU and memory consumption by sending specially crafted tracestate headers. The vulnerability was first flagged on 2026-08-28T16:35:03+00:00 and is currently under investigation.
The vulnerability arises from the way the package parses the tracestate header. The parser allocates a hash-map entry for each semicolon-separated key:value pair, which can be exploited to cause a Denial of Service. This issue has been reported in the datadog-opentelemetry package and is being tracked under GHSA-GPWF-4H98-V82Q.
What to do about it
- Upgrade to version 0.3.3 or later of the dd-trace-rs library to mitigate the vulnerability.
- Alternatively, disable tracecontext extraction by setting the DD_TRACE_PROPAGATION_STYLE_EXTRACT environment variable to a value that does not include tracecontext.
- Monitor the primary sources for updates on this vulnerability.
- Consult the primary sources for the most current information and recommended actions.
How 0Day would have caught this
datadog-opentelemetry is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the datadog-opentelemetry package in versions 0.1.0 to 0.3.2, you may be affected by this vulnerability.
What should I do right now?
Upgrade to version 0.3.3 or later of the dd-trace-rs library, or disable tracecontext extraction by setting the DD_TRACE_PROPAGATION_STYLE_EXTRACT environment variable to a value that does not include tracecontext.
Is there an official fix available?
Yes, version 0.3.3 of the dd-trace-rs library has been released to address this vulnerability.