CVE-2026-50270

Executive Summary

CVE-2026-50270 is an uncontrolled resource consumption vulnerability in dd-trace-java, the Datadog APM client for Java. Prior to version 1.62.0, the W3C baggage extraction path does not enforce the DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits, even though those limits are applied during baggage injection. A remote, unauthenticated attacker can send a baggage HTTP header with many comma-separated key-value pairs or a single oversized value, causing unbounded CPU and memory consumption and leading to denial of service in any Java HTTP service where baggage propagation is enabled (the default for most affected tracers).

Technical Analysis

dd-trace-java implements W3C Trace Context propagation, including the baggage HTTP header, which carries key-value pairs across service boundaries. The product defines two safety limits — DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) — that are intended to bound the size and number of baggage entries.

According to the NVD description, these limits are enforced on the baggage injection path (outbound propagation) but are not enforced on the baggage extraction path (inbound parsing). When an HTTP request arrives carrying a baggage header, the extraction routine parses the attacker-controlled header and allocates map entries for each comma-separated key-value pair, with no ceiling on either the number of entries or the total byte size.

The vulnerability class is CWE-770 (Allocation of Resources Without Limits or Throttling). The attack mechanism is straightforward: because parsing occurs on every inbound request and no bounds are applied, an attacker can supply:

• A header with a very large number of comma-separated key-value pairs, forcing allocation of an arbitrarily large map, or
• A single very large baggage value, forcing allocation of a large byte buffer.

Each such request drives CPU work (parsing, string splitting, map insertion) and memory allocation proportional to attacker-supplied input. Under concurrency, this produces sustained CPU saturation and heap pressure, potentially triggering excessive garbage collection and OutOfMemoryError conditions depending on heap configuration and request volume.

Notably, the description states that baggage propagation is enabled by default for most affected tracers, meaning the vulnerable extraction path is reachable without additional configuration in many deployments. No authentication is required; exploitation depends only on the ability to reach an HTTP endpoint instrumented by an affected tracer. The NVD description does not disclose the specific class or method names of the extraction routine, so no code-level identifiers can be confirmed beyond the two configuration parameters named above.

The fix is reported in version 1.62.0, where the extraction path is expected to apply the same item-count and byte-size limits already used during injection.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-770) and the NVD description. No specific function names, endpoints, or parameter names beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies an HTTP service built on a Java application instrumented with dd-trace-java prior to 1.62.0, where the baggage propagation style is enabled (the default for most affected tracers). Because the flaw is protocol-level and requires no application-specific knowledge, any reachable instrumented endpoint is a candidate. There is no need to authenticate.

2. Triggering the flaw. The attacker sends an HTTP request containing a baggage header. To exercise the unbounded map-entry allocation, the header contains a very large number of comma-separated key-value pairs; alternatively, the attacker sends a single very large baggage value to exercise unbounded byte allocation. The extraction path parses the header and allocates map entries per key-value pair without consulting DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES.

3. Payload / execution method. The payload is the baggage request header itself. No code execution, file upload, injection gadget, or authentication bypass is involved — the attack is a pure resource-consumption request pattern. Effectiveness scales with the number of entries (or value size) per request and the request rate.

4. Post-exploitation impact. Repeated or concurrent requests drive unbounded CPU and memory consumption in the instrumented service. Observed effects include elevated latency, thread-pool exhaustion, aggressive garbage collection, and, depending on heap sizing, out-of-memory termination. Because the tracer runs in-process, the DoS affects the host application, not merely the telemetry pipeline. No data confidentiality or integrity impact is described; the CVSS vector reflects availability-only impact.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The subscores indicate:

• Attack Vector: Network — the flaw is reachable over the network via standard HTTP requests.
• Attack Complexity: Low — no special conditions, race windows, or target-specific knowledge are required.
• Privileges Required: None and User Interaction: None — the attacker needs neither credentials nor a victim to click or approve anything.
• Scope: Unchanged — impact is contained within the vulnerable component's security authority.
• Confidentiality/Integrity: None — no data exposure or tampering is described.
• Availability: High — the resource-consumption condition can plausibly render the service unavailable.

EPSS is 0.00793 (54.6th percentile), indicating a low predicted probability of exploitation activity in the near term, consistent with the absence of public exploit code and the lack of CISA KEV listing. The blast radius within a single organization is potentially wide: because dd-trace-java is an APM client, it is likely deployed across many or all Java microservices in an estate, meaning the vulnerable parsing path may exist on every instrumented HTTP surface simultaneously. External exposure is bounded only by whether instrumented endpoints are internet-reachable; internal-only fleets remain exposed to authenticated or network-adjacent attackers as well as to any compromised workload able to reach them. Business impact is primarily service-availability: degraded SLOs, failed requests, and resource exhaustion in production without any data loss.

Detection Guidance

Sigma Rule

title: CVE-2026-50270 dd-trace-java Oversized W3C Baggage Header
id: 4f9c2b71-8a3d-4e56-b1c2-7d0e9a5f3c48
status: experimental
description: Detects HTTP requests with oversized or entry-flooded W3C baggage headers targeting Java services instrumented with dd-trace-java < 1.62.0
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-50270
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_baggage:
    cs-header|contains: 'baggage'
  selection_oversized:
    cs-header|re: '(?i)baggage:[^\r\n]{4096,}'
  selection_flood:
    cs-header|re: '(?i)baggage:([^,=]+=[^,]*,){65,}'
  condition: selection_baggage and (selection_oversized or selection_flood)
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-header
falsepositives:
  - Legitimate high-volume baggage propagation exceeding default limits
level: high

YARA Rule

rule CVE_2026_50270_DD_TRACE_BAGGAGE_OVERFLOW
{
    meta:
        description = "Detects oversized or entry-flooded W3C baggage headers targeting dd-trace-java extraction path"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50270"
        cve = "CVE-2026-50270"
        author = "Threat Intelligence"
        date = "2026-01-01"

    strings:
        $baggage = "baggage:" ascii nocase
        $dd_max_it = "DD_TRACE_BAGGAGE_MAX_ITEMS" ascii
        $dd_max_by = "DD_TRACE_BAGGAGE_MAX_BYTES" ascii

    condition:
        $baggage or $dd_max_it or $dd_max_by
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-50270 dd-trace-java Oversized W3C Baggage Header DoS Attempt"; flow:to_server,established; http.header_names; content:"baggage"; nocase; http.header; pcre:"/^baggage:[^\r\n]{4096,}/mi"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,CVE-2026-50270; sid:2026502701; rev:1;)

alert http any any -> any any (msg:"CVE-2026-50270 dd-trace-java Baggage Entry Flood"; flow:to_server,established; http.header_names; content:"baggage"; nocase; http.header; pcre:"/^baggage:([^,=]+=[^,]*,){65,}/mi"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-dos; reference:cve,CVE-2026-50270; sid:2026502702; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where http.request.method == "GET" or http.request.method == "POST" ]
  [ network where http.request.headers.baggage != null and
      (length(http.request.headers.baggage) > 4096 or
       stringContains(http.request.headers.baggage, "=")) ]

Splunk SPL Query

index=web OR index=proxy earliest=-24h
| eval baggage=coalesce(baggage_header, cs_header_baggage, http_baggage)
| where isnotnull(baggage)
| eval item_count=mvcount(split(baggage, ",")), header_len=len(baggage)
| where item_count > 64 OR header_len > 8192
| stats count AS attempts, dc(src_ip) AS unique_sources, max(item_count) AS max_items, max(header_len) AS max_len BY src_ip, uri_path
| where attempts > 5
| sort - attempts

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-50270,">
  <rule id="202650270" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.request.headers.baggage">\.</field>
    <description>CVE-2026-50270: W3C baggage header present - possible dd-trace-java extraction abuse</description>
    <options>no_full_log</options>
  </rule>

  <rule id="202650271" level="14">
    <decoded_as>json</decoded_as>
    <field name="http.request.headers.baggage">.{4096,}</field>
    <description>CVE-2026-50270: Oversized W3C baggage header - dd-trace-java DoS attempt (CWE-770)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED). A single source (the GitHub Security Advisory) claims version 1.62.0 resolves the issue; this has not been independently confirmed. The NVD description states the fix is in 1.62.0, but no vendor fix reference or advisory URL is listed in the data provided.

1) Immediate mitigations (if upgrade cannot be applied at once):

• Disable W3C baggage propagation for affected services where feasible. Since the flaw specifically affects the extraction path used when baggage propagation is enabled, reducing or removing baggage propagation removes the reachable attack surface at the cost of losing cross-service baggage context.
• Enforce request-header size limits at the edge (reverse proxy, API gateway, or WAF) so that baggage headers exceeding a conservative byte threshold are rejected before reaching the instrumented application. This compensates for the missing DD_TRACE_BAGGAGE_MAX_BYTES enforcement, though it does not fully replicate the 64-item enforcement.
• Apply rate limiting and connection concurrency caps per source on internet-facing instrumented endpoints to reduce the practical impact of flooding attempts.

2) Patch / upgrade steps:

• Upgrade dd-trace-java to version 1.62.0 or later across all Java services. Because dd-trace-java is typically deployed as an in-process agent, this is a build- and dependency-level change: update the tracer version in the build manifest or agent injection configuration, redeploy affected services, and verify the running tracer version through the Datadog APM telemetry or startup logs.
• Verify post-upgrade behavior by confirming that oversized/multi-entry baggage headers are trimmed or rejected on the extraction path as expected.
• Validate the patch due to the CLAIMED (2/4) confidence level — test in a staging environment before fleet-wide rollout.

3) Long-term hardening:

• Standardize on maximum inbound header sizes at the ingress tier for all services, independent of tracer behavior.
• Track dd-trace-java (and other APM agents) as first-class patched dependencies in SBOM and vulnerability management workflows, since in-process agents inherit the network exposure of the host application.
• Monitor published APM client advisories for this project; availability-only flaws in observability agents are frequently under-prioritized relative to application dependencies even when deployed to every service.

References

• NVD — CVE-2026-50270: https://nvd.nist.gov/vuln/detail/CVE-2026-50270
• GitHub Security Advisory (GHSA) — the single source cited in the patch data for CVE-2026-50270 (reference cited for the 1.62.0 fix).
• CWE-770: Allocation of Resources Without Limits or Throttling — https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• W3C Trace Context / Baggage specification (background on the baggage propagation header): https://www.w3.org/TR/baggage/

No public PoC, exploit code, or Nuclei template is known to exist for this vulnerability. EPSS is 0.00793 (54.6th percentile). The CVE is not listed in CISA KEV, and there is no evidence of in-the-wild exploitation or attribution to any threat actor campaign as of this report.