{"action":"Upgrade datadog-opentelemetry to 0.3.3 or later.","affected":[{"fixed":"0.3.3","introduced":"0.1.0"}],"component":"datadog-opentelemetry","cve_ids":["CVE-2026-54788"],"ecosystem":"crates.io","epss":0.00793,"exploited":false,"fixed_versions":["0.3.3"],"ghsa_id":"GHSA-gpwf-4h98-v82q","id":"tcs_01M5KF02ZRJT14WJSH9F9YMEYC","modified_at":"2026-08-28T16:55:35.433397Z","published_at":"2026-08-28T16:35:03Z","references":["https://osv.dev/vulnerability/GHSA-gpwf-4h98-v82q","https://github.com/DataDog/dd-trace-rs/security/advisories/GHSA-gpwf-4h98-v82q","https://github.com/DataDog/dd-trace-rs/pull/218","https://github.com/DataDog/dd-trace-rs/commit/77c5d185c71d0ea8103da0e6cf4cd50677ffacd2","https://github.com/DataDog/dd-trace-rs","https://github.com/DataDog/dd-trace-rs/releases/tag/datadog-opentelemetry-v0.3.3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-gpwf-4h98-v82q","url":"https://osv.dev/vulnerability/GHSA-gpwf-4h98-v82q"}],"summary":"datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS"}