An unauthenticated remote attacker can cause a denial of service in applications using the DataDog dd-trace-rs library by sending maliciously crafted headers that consume excessive system resources.

The vulnerability exists within the tracecontext.rs file, where the library fails to enforce size or count limits when parsing W3C tracestate headers. This allows an unauthenticated attacker to inject arbitrarily large entries into a HashMap, leading to CPU and memory exhaustion.

The exploitation of this vulnerability directly impacts service availability. Because the tracecontext extraction feature is enabled by default, most instrumented services are vulnerable to a denial of service attack that can render business-critical applications unresponsive. With a CVSS score of 7.5, this high-severity flaw necessitates immediate attention to prevent service degradation or complete outages.

Immediate Action: Update the datadog-opentelemetry crate to version 0.3.3 or later to implement necessary resource limits.

Proactive Monitoring: Monitor server CPU and memory utilization patterns for sudden spikes that correlate with incoming network requests, and review web server logs for unusually large or malformed header entries.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an ingress controller policy to filter or truncate excessively large W3C tracestate headers before they reach the application layer.

Public Exploit Available: Unknown

Given the high impact on service availability and the ease with which an unauthenticated attacker can trigger this condition, organizations should prioritize updating the vulnerable library. Ensure all Rust-based services utilizing the dd-trace-rs package are patched to version 0.3.3 to eliminate this resource exhaustion vector.