CVE-2026-50276: 
Ruby vulnerability analysis and mitigation

CVE-2026-50276 is a Denial of Service vulnerability in the Datadog Ruby tracing library (dd-trace-rb) caused by improper parsing of W3C baggage HTTP headers. The library fails to enforce item-count or byte-size limits during baggage header extraction, allowing a remote, unauthenticated attacker to trigger unbounded CPU and memory consumption. It affects all versions of the datadog RubyGems package prior to 2.32.0. The advisory was originally published on June 5, 2026, and added to the GitHub Advisory Database on July 15, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, DataDog Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) configuration limits were only applied to baggage injection (outbound), not extraction (inbound). As a result, when the tracer processes an incoming HTTP request, it parses the baggage header and allocates a hash-map entry for every comma-separated key-value pair without any upper bound. An attacker can craft a single HTTP request with an oversized baggage header containing thousands of key-value pairs or a single extremely large value, causing the server to exhaust memory and CPU on each such request. Because baggage propagation is enabled by default, no special configuration is required to be vulnerable (GitHub Advisory, DataDog Advisory).

Successful exploitation causes unbounded CPU and memory consumption on the targeted HTTP service, resulting in a complete availability impact (Denial of Service). There is no confidentiality or integrity impact — the vulnerability cannot be used to access or modify data. Any internet-facing Ruby service instrumented with an affected version of dd-trace-rb and using the default propagation style is exposed, potentially making entire application tiers unavailable with a low volume of crafted requests (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The CVE status remains "Reserved" and the EPSS score is 0.106% (28th percentile), indicating a currently low probability of exploitation within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and low complexity, making it straightforward to exploit if a target is identified (GitHub Advisory).

1. Reconnaissance: Identify internet-facing HTTP services instrumented with the Datadog Ruby tracer (dd-trace-rb < 2.32.0) by examining HTTP response headers, error messages, or job listings referencing Datadog APM with Ruby.
2. Verify baggage propagation: Confirm that the target accepts and processes the baggage W3C header by sending a benign test request with a small baggage header (e.g., baggage: key1=val1) and observing no rejection.
3. Craft malicious request: Construct an HTTP request with an oversized baggage header containing a very large number of comma-separated key-value pairs (e.g., thousands of keyN=valueN entries) or a single extremely large value exceeding the default 8192-byte limit.
4. Send the request: Transmit the crafted request to any HTTP endpoint of the target service using tools like curl or a custom script: curl -H 'baggage: key1=val1,key2=val2,...,keyN=valN' https://target.example.com/.
5. Sustain the attack: Repeat the request in a loop or with multiple concurrent connections to maintain resource exhaustion, as each request independently triggers unbounded allocation on the server (GitHub Advisory, DataDog Advisory).

• Network: Repeated HTTP requests to application endpoints containing abnormally large baggage headers (exceeding 8 KB or containing hundreds of comma-separated key-value pairs); high request rates from a single or small set of source IPs targeting the same endpoint.
• Logs: Web server or proxy access logs showing requests with oversized baggage header values; application logs showing memory allocation errors or garbage collection pressure in the Ruby process.
• Process: Sudden spike in CPU and memory usage by the Ruby application process (ruby, puma, unicorn, passenger) without a corresponding increase in legitimate traffic; out-of-memory (OOM) kills of the application process.

Upgrade the datadog RubyGems package to version 2.32.0 or later, which enforces item-count and byte-size limits on baggage header extraction. If an immediate upgrade is not possible, apply one or both of the following workarounds: (1) Disable baggage extraction by removing baggage from the DD_TRACE_PROPAGATION_STYLE environment variable (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently); (2) Cap the maximum HTTP request header size at an upstream proxy or web server using directives such as Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb (GitHub Advisory, DataDog Advisory).

The advisory references related upstream vulnerabilities in other OpenTelemetry tracing libraries — opentelemetry-go (GHSA-mh2q-q3fh-2475) and opentelemetry-dotnet (GHSA-g94r-2vxg-569j) — indicating this is a broader class of issue affecting W3C baggage propagation implementations across multiple ecosystems. No notable public researcher commentary or significant social media discussion has been identified beyond the official advisory (GitHub Advisory).