dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.

CVE-2026-54788 affects dd-trace-rs, Datadog's application performance monitoring library for Rust. Versions 0.1.0 through 0.3.2 are vulnerable to a denial-of-service attack via the W3C tracestate header parsing logic. The vulnerable code in tracecontext.rs collects all semicolon-separated key-value pairs from the Datadog dd=... vendor entry into a HashMap with no limit on pair count or entry size. Since tracecontext extraction is enabled by default, a remote unauthenticated attacker can craft an arbitrarily large dd=... header value to force excessive CPU and memory consumption on each request. This can effectively bring down any instrumented Rust network service. The vulnerability has been patched in version 0.3.3 of the datadog-opentelemetry crate.