StackRadar

CVE-2026-50274

High

Advisory

Published 15 Jul 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
10
of 17,781 indexed, latest versions
Container images
9
deployed by those charts
Fix available
1 of 1
affected package

dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS

Carried by container images the latest versions of 10 of 17,781 indexed charts deploy, on 9 images.

Affected packageAffected versionsFixed inImages
github.com/DataDog/dd-trace-go/v2golangv2.0.0, v2.0.1, v2.2.3, v2.4.02.8.19
OSV records
GHSA-74j5-xf3v-crq8
Also known as
GO-2026-6000

Charts affected

10 by stars
ChartLatestAffected imagesRadar Score
node-local-dnsdeliveryheroVerified publisher2.9.21 of 1See more

node-local-dns deliveryhero 2.9.2

1 of the 1 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
registry.k8s.io/dns/k8s-dns-node-cache:1.26.78b9a78d101a1
github.com/DataDog/dd-trace-go/v2@v2.2.3
2.8.1

Open the chart page →

1,685
imgproxyimgproxy1.1.01 of 1See more

imgproxy imgproxy 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
ghcr.io/imgproxy/imgproxy:v3.30.074c1bee92e04
github.com/DataDog/dd-trace-go/v2@v2.2.3
2.8.1

Open the chart page →

2,321
wireguardslybase-wireguardVerified publisher2.0.61 of 1See more

wireguard slybase-wireguard 2.0.6

1 of the 1 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
linuxserver/wireguard:1.0.20260223-r0-ls122dca67384e3e9
github.com/DataDog/dd-trace-go/v2@v2.4.0
2.8.1

Open the chart page →

436
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.30.13b709e4a0e5e
github.com/DataDog/dd-trace-go/v2@v2.2.3
2.8.1

Open the chart page →

18,075
wireguardalexpressoVerified publisher0.1.31 of 2See more

wireguard alexpresso 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
linuxserver/wireguard:latestbf03578ef731
github.com/DataDog/dd-trace-go/v2@v2.4.0
2.8.1

Open the chart page →

780
coder-logstream-kubecoder-logstream-kube0.0.151 of 1See more

coder-logstream-kube coder-logstream-kube 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
ghcr.io/coder/coder-logstream-kube:v0.0.1510ae596d296e
github.com/DataDog/dd-trace-go/v2@v2.0.0
2.8.1

Open the chart page →

885
corednsjouveVerified publisher1.45.01 of 1See more

coredns jouve 1.45.0

1 of the 1 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
coredns/coredns:1.13.19b9128672209
github.com/DataDog/dd-trace-go/v2@v2.2.3
2.8.1

Open the chart page →

887
tailscalesinextraVerified publisher0.18.11 of 2See more

tailscale sinextra 0.18.1

1 of the 2 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
github.com/DataDog/dd-trace-go/v2@v2.4.0
2.8.1

Open the chart page →

1,047
group-challengesubshell-labVerified publisher2.1.01 of 2See more

group-challenge subshell-lab 2.1.0

1 of the 2 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.29.17d12c7c8fc66
github.com/DataDog/dd-trace-go/v2@v2.0.1
2.8.1

Open the chart page →

2,540
corednsvks-helm-chartsVerified publisher1.45.01 of 1See more

coredns vks-helm-charts 1.45.0

1 of the 1 container images this version deploys carry CVE-2026-50274.

Container imageDigestPackageFixed in
coredns/coredns:1.13.19b9128672209
github.com/DataDog/dd-trace-go/v2@v2.2.3
2.8.1

Open the chart page →

887

Container images carrying it

9 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
coredns/coredns:1.13.19b9128672209
github.com/DataDog/dd-trace-go/v2@v2.2.3
2.8.1
2
darthsim/imgproxy:v3.30.13b709e4a0e5e
github.com/DataDog/dd-trace-go/v2@v2.2.3
2.8.1
1
darthsim/imgproxy:v3.29.17d12c7c8fc66
github.com/DataDog/dd-trace-go/v2@v2.0.1
2.8.1
1
linuxserver/wireguard:latestbf03578ef731
github.com/DataDog/dd-trace-go/v2@v2.4.0
2.8.1
1
linuxserver/wireguard:1.0.20260223-r0-ls122dca67384e3e9
github.com/DataDog/dd-trace-go/v2@v2.4.0
2.8.1
1
ghcr.io/coder/coder-logstream-kube:v0.0.1510ae596d296e
github.com/DataDog/dd-trace-go/v2@v2.0.0
2.8.1
1
ghcr.io/imgproxy/imgproxy:v3.30.074c1bee92e04
github.com/DataDog/dd-trace-go/v2@v2.2.3
2.8.1
1
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
github.com/DataDog/dd-trace-go/v2@v2.4.0
2.8.1
1
registry.k8s.io/dns/k8s-dns-node-cache:1.26.78b9a78d101a1
github.com/DataDog/dd-trace-go/v2@v2.2.3
2.8.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.