CVE-2026-50270: 
Java 취약성 분석 및 완화

CVE-2026-50270 is a Denial of Service vulnerability in the Datadog dd-trace-java tracing library caused by improper parsing of W3C baggage HTTP headers. The library fails to enforce item-count or byte-size limits during baggage header extraction, allowing a remote, unauthenticated attacker to trigger unbounded CPU and memory consumption. It affects com.datadoghq:dd-java-agent versions prior to 1.62.0. The advisory was originally published on June 5, 2026, and added to the GitHub Advisory Database on July 15, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, DataDog Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The existing limits DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) were only applied to baggage injection (outbound), not extraction (inbound parsing). On every inbound HTTP request, the tracer allocates a hash-map entry for each comma-separated key-value pair found in the baggage header without any cap, meaning an attacker can craft a single request with an arbitrarily large number of pairs or a single oversized value to exhaust server resources. Because baggage propagation is enabled by default in most affected tracer configurations, no special preconditions or authentication are required (GitHub Advisory, DataDog Advisory).

Successful exploitation causes unbounded CPU and memory consumption on the targeted Java service, resulting in service degradation or complete unavailability (Denial of Service). There is no confidentiality or integrity impact — the vulnerability is purely an availability concern. Any internet-facing HTTP service instrumented with an affected version of dd-trace-java and using the default propagation style is exposed, potentially affecting production workloads at scale (GitHub Advisory).

1. Reconnaissance: Identify internet-facing HTTP services instrumented with dd-trace-java versions prior to 1.62.0. This may be inferred from response headers, error messages, or service fingerprinting.
2. Craft malicious request: Construct an HTTP request containing a baggage header with an arbitrarily large number of comma-separated key-value pairs (e.g., baggage: k1=v1,k2=v2,...,kN=vN with thousands of entries) or a single extremely large value exceeding normal bounds.
3. Send request: Transmit the crafted request to any HTTP endpoint of the target service. No authentication or special privileges are required.
4. Trigger resource exhaustion: The tracer's extraction logic allocates a hash-map entry for each pair without limit, causing rapid CPU and memory consumption on the server.
5. Sustain DoS: Repeat requests at a moderate rate to maintain resource pressure, preventing the service from handling legitimate traffic and potentially causing an out-of-memory crash (GitHub Advisory, DataDog Advisory).

• Network: Inbound HTTP requests containing abnormally large or highly repetitive baggage headers (e.g., hundreds or thousands of comma-separated key-value pairs, or a single header value exceeding several kilobytes).
• Logs: Web server or proxy access logs showing repeated requests with oversized baggage header values from the same or rotating source IPs; application logs showing Java OutOfMemoryError or GC overhead limit exceeded errors.
• Process: Java process exhibiting sudden spikes in CPU and heap memory usage correlated with incoming HTTP traffic; JVM garbage collection logs showing continuous full GC cycles with little memory reclaimed.

Upgrade com.datadoghq:dd-java-agent to version 1.62.0 or later, which enforces item-count and byte-size limits on baggage header extraction as well as injection. If an immediate upgrade is not possible, apply one or both of the following workarounds: (1) Disable baggage extraction by removing baggage from the DD_TRACE_PROPAGATION_STYLE environment variable (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if configured independently); (2) Cap the maximum HTTP request header size at an upstream proxy or web server using directives such as Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb (GitHub Advisory, DataDog Advisory).

The advisory references related upstream vulnerabilities in other OpenTelemetry tracing libraries — opentelemetry-go (GHSA-mh2q-q3fh-2475) and opentelemetry-dotnet (GHSA-g94r-2vxg-569j) — indicating this is a broader ecosystem issue with W3C baggage propagation implementations lacking extraction-side limits. No notable public researcher commentary or significant social media discussion has been identified beyond the official advisory (GitHub Advisory).