Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the dd-trace-java library's handling of W3C baggage propagation, where incoming baggage HTTP headers were parsed without enforcing limits on the number of items or the total byte size. The advisory points to the lack of limits on the extraction path, which was resolved in version 1.62.0.
By comparing the git tags for versions v1.61.1 and v1.62.0, I identified the fixing commit 16c6a5fd1fed71cef6c35f69122f19f5ee242757. The commit message, "feat(core): Add items and bytes limits to baggage extraction", directly confirms its relevance.
The patch modifies the dd-trace-core/src/main/java/datadog/trace/core/baggage/BaggagePropagator.java file. Specifically, it alters the parseBaggageHeaders method within the BaggageExtractor inner class. Before the patch, this method would loop through the baggage header string and create a map entry for each key-value pair without any limits. The patch introduces checks for maxItems and maxBytes at the beginning of the loop, effectively throttling the number of pairs processed.
The vulnerable function is datadog.trace.core.baggage.BaggagePropagator$BaggageExtractor.parseBaggageHeaders, as it's the exact location of the unbounded resource allocation. The public-facing method that triggers this vulnerable code is datadog.trace.core.baggage.BaggagePropagator.extract, which takes the carrier containing the malicious header as input. Therefore, both functions are critical runtime indicators for this vulnerability.
datadog.trace.core.baggage.BaggagePropagator.extractdd-trace-core/src/main/java/datadog/trace/core/baggage/BaggagePropagator.java
datadog.trace.core.baggage.BaggagePropagator$BaggageExtractor.parseBaggageHeadersdd-trace-core/src/main/java/datadog/trace/core/baggage/BaggagePropagator.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.datadoghq:dd-java-agent | maven | < 1.62.0 | 1.62.0 |