CVE-2026-50276

Datadog's dd-trace-rb Ruby tracing library fails to enforce the configured item and byte limits (DD_TRACE_BAGGAGE_MAX_ITEMS, default 64, and DD_TRACE_BAGGAGE_MAX_BYTES, default 8192) when parsing incoming W3C baggage HTTP headers, even though those limits are applied during injection. A remote, unauthenticated attacker can send a single HTTP request carrying a baggage header with many comma-separated key-value pairs or one very large value, causing the extraction path to allocate unbounded CPU and memory on every request. Successful exploitation exhausts resources and causes denial of service of the Ruby HTTP service; there is no impact on confidentiality or integrity. Any application running dd-trace-rb prior to 2.32.0 with baggage propagation enabled (the default for most affected tracers) is at risk. The issue is fixed in version 2.32.0, and there is no known public proof of concept or observed exploitation to date.

What to do: Upgrade dd-trace-rb to version 2.32.0 or later as soon as possible. If immediate upgrade is not feasible, disable W3C baggage extraction by setting DD_TRACE_PROPAGATION_STYLE (or the equivalent propagation configuration) to exclude baggage (e.g., tracecontext only), or strip/drop baggage headers at the edge (load balancer, reverse proxy, or WAF). Monitor Ruby application processes for abnormal memory and CPU growth per request, which would indicate header-based resource exhaustion attempts.