Datadog dd-trace-php vulnerabilities

Latest Datadog dd-trace-php CVEs

Newest publication first

1. CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

   Published 2026-09-17

   High·CVSS 7.5 EPSS 0.68%

   The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.