Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dd-trace | npm | < 5.100.0 | 5.100.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the improper parsing of W3C baggage headers, which could lead to a Denial of Service. The advisory states that the dd-trace-js library did not enforce item-count or byte-size limits on the baggage extraction path. By analyzing the commits between the last vulnerable version and the patched version 5.100.0, I identified the commit a7d4c0da05f67cde05a99272b725a317c461d0e6 with the message 'fix(propagation): enforce baggageMax* caps on extract'. This commit directly addresses the vulnerability. The main vulnerable function is TextMapPropagator._extractBaggageItems in packages/dd-trace/src/opentracing/propagation/text_map.js. This function was modified to include checks for baggageMaxItems and baggageMaxBytes, thus mitigating the DoS risk. Additionally, the ContextManager.with function in packages/dd-trace/src/opentelemetry/context_manager.js was also modified to handle baggage more efficiently, indicating it is part of the vulnerable execution path when using OpenTelemetry.
TextMapPropagator._extractBaggageItemspackages/dd-trace/src/opentracing/propagation/text_map.js
ContextManager.withpackages/dd-trace/src/opentelemetry/context_manager.js