StackRadarChart IndexLive demo

CVE-2026-50271

High

Advisory

Published 15 Jul 2026In the index since 8 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.008; 54th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 7; of 17,781 indexed, latest versions
Container images: 7; deployed by those charts
Fix available: 1 of 1; affected package

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

Carried by container images the latest versions of 7 of 17,781 indexed charts deploy, on 7 images.

Affected package	Affected versions	Fixed in	Images
ddtracepypi	0.32.2, 0.46.0, 0.53.2, 2.19.0+2 more	4.8.2	7

OSV records: GHSA-mw54-j2v2-42hr
Also known as: PYSEC-2026-3461

Charts affected

7 by stars

Chart

Latest

Affected images

Radar Score

datadogdatadog-test

1 of 2 See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2026-50271.

Container image	Digest	Package	Fixed in
datadog/agent :7.22.0	8f20e56b5311	ddtrace@0.32.2	4.8.2

Open the chart page →

4,568

litellmlitellm-helm

1 of 1 See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-50271.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm-database :litellm_stable_release_branch-v1.75.5-stable	ab63d26a8a2c	ddtrace@2.19.0	4.8.2

Open the chart page →

4,292

airbyteairbyte-v2

1 of 10 See more

airbyte airbyte-v2 2.2.0

1 of the 10 container images this version deploys carry CVE-2026-50271.

Container image	Digest	Package	Fixed in
airbyte/manifest-server :7.23.7	3b3a670af168	ddtrace@3.16.0	4.8.2

Open the chart page →

12,473

1 of 8 See more

codecov douban 0.2.4

1 of the 8 container images this version deploys carry CVE-2026-50271.

Container image	Digest	Package	Fixed in
codecov/self-hosted-api :24.4.1	0475cb1c3136	ddtrace@0.46.0	4.8.2

Open the chart page →

24,917

datadog-apmfairwinds-incubator

1 of 1 See more

datadog-apm fairwinds-incubator 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-50271.

Container image	Digest	Package	Fixed in
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	ddtrace@3.16.4	4.8.2

Open the chart page →

2,785

jx-app-datadogjenkins-x

1 of 2 See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-50271.

Container image	Digest	Package	Fixed in
datadog/agent :6	aad9994de6a7	ddtrace@0.53.2	4.8.2

Open the chart page →

3,999

showroom-docs-mcpshowroom-docs-mcp

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-50271.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	ddtrace@2.19.0	4.8.2

Open the chart page →

5,201

Container images carrying it

7 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
airbyte/manifest-server :7.23.7	3b3a670af168	ddtrace@3.16.0	4.8.2	1
codecov/self-hosted-api :24.4.1	0475cb1c3136	ddtrace@0.46.0	4.8.2	1
datadog/agent :7.22.0	8f20e56b5311	ddtrace@0.32.2	4.8.2	1
datadog/agent :6	aad9994de6a7	ddtrace@0.53.2	4.8.2	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	ddtrace@2.19.0	4.8.2	1
ghcr.io/berriai/litellm-database :litellm_stable_release_branch-v1.75.5-stable	ab63d26a8a2c	ddtrace@2.19.0	4.8.2	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	ddtrace@3.16.4	4.8.2	1