dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses t…

CVE-2026-54788 affects dd-trace-rs, Datadog's application performance monitoring library for Rust. Versions 0.1.0 through 0.3.2 are vulnerable to a denial-of-service attack via the W3C tracestate header parsing logic. The vulnerable code in tracecontext.rs collects all semicolon-separated key-value pairs from the Datadog dd=... vendor entry into a HashMap with no limit on pair count or entry size. Since tracecontext extraction is enabled by default, a remote unauthenticated attacker can craft an arbitrarily large dd=... header value to force excessive CPU and memory consumption on each request. This can effectively bring down any instrumented Rust network service. The vulnerability has been patched in version 0.3.3 of the datadog-opentelemetry crate.