dd-trace-rb CVE-2026-50276
HIGH
GHSA-p5f6-rccc-jv98
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated attacker sends a crafted header with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion, so C:N/I:N/A:H, scope unchanged.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.
Patches
This is resolved in version 2.32.0 and later of the dd-trace-rb library.
Workarounds
If users cannot upgrade immediately:
- Disable
baggageextraction by removingbaggagefromDD_TRACE_PROPAGATION_STYLE(orDD_TRACE_PROPAGATION_STYLE_EXTRACTif set independently). - Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache
LimitRequestFieldSize, Nginxlarge_client_header_buffers, Envoymax_request_headers_kb).
Resources
Related upstream advisories: opentelemetry-go GHSA-mh2q-q3fh-2475 opentelemetry-dotnet GHSA-g94r-2vxg-569j
Articles & Coverage 2
AnalysisAI
Remote unauthenticated Denial of Service in Datadog's dd-trace-rb Ruby tracing library (versions before 2.32.0) allows attackers to exhaust CPU and memory by sending HTTP requests with oversized or high-cardinality W3C baggage headers. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) limits were enforced only on injection and not extraction, the tracer allocates a hash-map entry per comma-separated pair on every request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Ruby service be instrumented with dd-trace-rb (`datadog` gem) before version 2.32.0 AND have the `baggage` propagation style enabled on the extract path - which is the default in most affected tracers, so no non-default configuration is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures a network-reachable, low-complexity, unauthenticated availability-only impact with no confidentiality or integrity loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an internet-facing Ruby web service instrumented with a vulnerable dd-trace-rb version and sends HTTP requests carrying a `baggage` header packed with tens of thousands of comma-separated key-value pairs (or one enormous value). Each request forces the tracer to allocate a hash-map entry per pair, and a modest flood of such requests exhausts CPU and memory, degrading or crashing the service. … |
| Remediation | Vendor-released patch: upgrade the `datadog` RubyGem to version 2.32.0 or later, which enforces the item-count and byte-size limits on the extract path, per GHSA-p5f6-rccc-jv98 (https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Ruby application inventory to identify all services running dd-trace-rb versions before 2.32.0 and determine which are internet-facing or exposed to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today