CVE-2026-50276
Received Received - Intake

Denial of Service in dd-trace-rb via W3C Baggage Header

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 2.32.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-50276
EUVD
EUVD-2026-77671

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
datadog dd-trace-rb to 2.32.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the DataDog dd-trace-rb library versions prior to 2.32.0. It involves improper parsing of W3C baggage headers, where limits on the number of items (default 64) or size of baggage headers (default 8192 bytes) are not enforced during extraction. Attackers can send requests with excessively large baggage headers containing many key-value pairs or a single large value, causing the tracer to allocate excessive memory and CPU resources, leading to denial of service.

Detection Guidance

Check if your dd-trace-rb version is below 2.32.0 by running gem list dd-trace-rb. Monitor HTTP request headers for unusually large baggage values or excessive key-value pairs. Use tools like tcpdump or Wireshark to inspect incoming requests for malformed baggage headers.

Impact Analysis

If you use a vulnerable version of dd-trace-rb (prior to 2.32.0) with default settings, internet-facing services instrumented with this library could be exposed to denial of service attacks. Attackers may send specially crafted requests that consume excessive server resources, potentially crashing or slowing down your application.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks on systems handling sensitive data. GDPR requires protecting personal data availability, while HIPAA mandates ensuring healthcare systems remain operational. A DoS condition could disrupt services processing such data, potentially violating availability requirements.

Mitigation Strategies

Upgrade dd-trace-rb to version 2.32.0 or later immediately. Disable baggage extraction if not required by setting DD_TRACE_BAGGAGE_ENABLED=false. Configure upstream proxies or web servers to cap HTTP header sizes to prevent oversized baggage headers from reaching the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart