dd-trace-rb CVE-2026-50276

Exploitation requires that the target Ruby service be instrumented with dd-trace-rb (datadog gem) before version 2.32.0 AND have the baggage propagation style enabled on the extract path - which is the default in most affected tracers, so no non-default configuration is needed. The attacker only needs network reachability to an HTTP endpoint that processes the incoming baggage header; per PR:N/UI:N no authentication or user interaction is required. The primary limiting factor is deployment-specific: services that have explicitly narrowed DD_TRACE_PROPAGATION_STYLE/DD_TRACE_PROPAGATION_STYLE_EXTRACT to exclude baggage, or that sit behind a proxy enforcing strict header-size caps, are not exposed. Impact is confined to availability (C:N/I:N/A:H) - no code execution or data disclosure.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures a network-reachable, low-complexity, unauthenticated availability-only impact with no confidentiality or integrity loss. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so exploitation likelihood must be inferred from the mechanics rather than measured signals. The attack is trivially automatable and requires no special conditions beyond the default-enabled baggage propagation style, which raises real-world concern; however, the impact ceiling is service disruption only, not compromise. This is a legitimate availability priority for internet-facing Ruby services but is not a data-breach-class emergency - absent KEV or EPSS data, treat exploitation as plausible-but-unconfirmed rather than known-active.

An attacker identifies an internet-facing Ruby web service instrumented with a vulnerable dd-trace-rb version and sends HTTP requests carrying a baggage header packed with tens of thousands of comma-separated key-value pairs (or one enormous value). Each request forces the tracer to allocate a hash-map entry per pair, and a modest flood of such requests exhausts CPU and memory, degrading or crashing the service. No public exploit was identified at time of analysis, but the technique is simple to script given AV:N/AC:L/PR:N.