datadog-opentelemetry Crate Vulnerability: Unbounded W3C Tracestate Parsing
- Severity
- HIGH
- Affected component
- datadog-opentelemetry (cargo)
- Affected versions
- >= 0.1.0, < 0.3.3
- Patched version
- 0.3.3
An early warning has been issued for a vulnerability in the datadog-opentelemetry Rust crate that may lead to a Denial of Service. Users of versions 0.1.0 to 0.3.2 are reportedly affected.
What happened
The datadog-opentelemetry Rust crate has an unbounded W3C tracestate parsing vulnerability that may lead to a Denial of Service. This vulnerability allows a remote, unauthenticated attacker to send a tracestate header with an arbitrarily large number of key:value pairs, causing unbounded CPU and memory consumption per request. The issue was first flagged on 2026-08-28T16:35:03+00:00 and is under investigation.
The affected versions of the datadog-opentelemetry crate are from 0.1.0 to 0.3.2. The vulnerability is reportedly present in these versions because they do not limit the size of the tracestate header, allowing for potential abuse. The recommended action is to upgrade to version 0.3.3 or later of the dd-trace-rs library.
What to do about it
- Upgrade to version 0.3.3 or later of the dd-trace-rs library to mitigate the vulnerability.
- If an immediate upgrade is not possible, disable tracecontext extraction by setting DD_TRACE_PROPAGATION_STYLE_EXTRACT to a value that does not include tracecontext.
- Alternatively, cap the maximum HTTP request header size at an upstream proxy or web server to limit the impact of the vulnerability.
How 0Day would have caught this
datadog-opentelemetry is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using the datadog-opentelemetry crate in versions 0.1.0 to 0.3.2.
What should I do right now?
Upgrade to version 0.3.3 or later of the dd-trace-rs library. If an immediate upgrade is not possible, disable tracecontext extraction or cap the maximum HTTP request header size.
Is there an official fix available?
Yes, version 0.3.3 of the dd-trace-rs library is the patched version.
Has this been exploited in the wild?
There is no confirmed evidence that this vulnerability has been exploited in the wild.