What is the CVSS score of CVE-2026-50276?

CVE-2026-50276 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Which versions of dd-trace-rb are affected by CVE-2026-50276?

The Datadog dd-trace-rb Ruby tracing library (versions prior to 2.32.0) contains an unauthenticated remote denial-of-service vulnerability allowing attackers to exhaust CPU and memory on…. A patch is available.

How to fix or mitigate CVE-2026-50276?

Within 24 hours, audit your Ruby application inventory to identify all services running dd-trace-rb versions before 2.32.0 and determine which are internet-facing or exposed to untrusted networks. Within 7 days, deploy Web Application Firewall (WAF) rules to reject HTTP requests with oversized or high-cardinality W3C baggage headers, disable trace baggage propagation in non-production environments where not required, and enable request rate limiting and connection throttling on all affected production services. Within 30 days, establish baseline monitoring for abnormal CPU and memory consumption on vulnerable services, prepare upgrade documentation for when a vendor patch becomes available, and validate any future patches in staging environments before production deployment.

dd-trace-rb CVE-2026-50276

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-15 https://github.com/DataDog/dd-trace-rb

GHSA-p5f6-rccc-jv98

Nginx Apache Denial Of Service

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated attacker sends a crafted header with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion, so C:N/I:N/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 23:30 vuln.today

Analysis Generated

Jul 15, 2026 - 23:30 vuln.today

CVE Published

Jul 15, 2026 - 23:07 github-advisory

HIGH 7.5

DescriptionGitHub Advisory

Impact

Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.

Patches

This is resolved in version 2.32.0 and later of the dd-trace-rb library.

Workarounds

If users cannot upgrade immediately:

Disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently).
Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb).

Resources

Articles & Coverage 2

News 11 New Nginx Vulnerabilities - 1 Critical, 10 High Severity Jul 16, 2026 News 9 New Apache Vulnerabilities - 9 High Severity, No Public Exploits Jul 16, 2026

AnalysisAI

Remote unauthenticated Denial of Service in Datadog's dd-trace-rb Ruby tracing library (versions before 2.32.0) allows attackers to exhaust CPU and memory by sending HTTP requests with oversized or high-cardinality W3C baggage headers. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) limits were enforced only on injection and not extraction, the tracer allocates a hash-map entry per comma-separated pair on every request. Baggage propagation is enabled by default, so any internet-facing instrumented Ruby service is exposed; no public exploit was identified at time of analysis, and this CVE is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in the W3C Trace Context / OpenTelemetry baggage propagation mechanism, a standard for carrying arbitrary key-value pairs across distributed-tracing hops via the baggage HTTP header. dd-trace-rb (the datadog RubyGem, CPE pkg:rubygems/datadog) parses this header on the extract path by splitting on commas and allocating a hash-map entry for each pair, but omitted the count and byte-size caps that already guarded the inject path. This is a classic CWE-400 Uncontrolled Resource Consumption: attacker-controlled input directly drives unbounded allocation and CPU work. The same defect class was addressed in sibling libraries opentelemetry-go (GHSA-mh2q-q3fh-2475) and opentelemetry-dotnet (GHSA-g94r-2vxg-569j), indicating a cross-ecosystem baggage-parsing pattern.

RemediationAI

Vendor-released patch: upgrade the datadog RubyGem to version 2.32.0 or later, which enforces the item-count and byte-size limits on the extract path, per GHSA-p5f6-rccc-jv98 (https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98). If immediate upgrade is not possible, disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently), with the trade-off that inbound baggage context will no longer be propagated into traces. As an additional layer, cap maximum HTTP request header size at an upstream proxy or web server - for example Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb - noting that overly aggressive limits may reject legitimate large-header requests and must be tuned to your application.