Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/DataDog/dd-trace-go | go | <= 1.24.1 | |
| github.com/DataDog/dd-trace-go/v2 | go | < 2.8.1 | 2.8.1 |
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states that the dd-trace-go library is vulnerable to a DoS attack due to improper parsing of W3C baggage headers, where item-count and byte-size limits were not enforced on the extraction path. The advisory points to version 2.8.1 as the patched version. By comparing the git tags for versions v2.8.0 and v2.8.1 of the DataDog/dd-trace-go repository, I identified a commit with the message 'fix(tracer): enforce baggage item and byte limits on extraction'. Analyzing this commit reveals changes in the ddtrace/tracer/textmap.go file, specifically within the (*propagatorBaggage).extractTextMap function. The patch introduces logic to count the number of baggage items and their total byte size, and to stop processing if pre-defined limits (baggageMaxItems and baggageMaxBytes) are exceeded. This directly addresses the vulnerability described. Therefore, the propagatorBaggage.extractTextMap function is the vulnerable function.
propagatorBaggage.extractTextMapddtrace/tracer/textmap.go