CVE-2026-50275

Executive Summary

CVE-2026-50275 is a remote denial-of-service vulnerability in the Datadog PHP Tracer (ddtrace), affecting versions prior to 1.19.2. The flaw resides in the ddtrace_deserialize_baggage function within ext/distributed_tracing_headers.c, which parses incoming W3C baggage HTTP headers without enforcing the configured limits DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. An unauthenticated, remote attacker can send a single request carrying an arbitrarily large number of comma-separated key-value pairs (or one oversized value), forcing unbounded hash-map allocations and CPU consumption on each request. Because baggage extraction is enabled by default in most deployments, any internet-facing PHP application instrumented with an affected ddtrace build is exposed to trivial resource-exhaustion attacks (CVSS 7.5, availability-only).

Technical Analysis

The Datadog PHP Tracer is a native PHP extension that provides APM and distributed tracing. Part of its W3C Trace Context propagation implementation handles "baggage" — arbitrary key-value metadata transmitted via HTTP headers (typically baggage:) alongside trace context. The vulnerable code path is the C function ddtrace_deserialize_baggage, implemented in ext/distributed_tracing_headers.c. This function parses the incoming baggage header and constructs hash-map entries from comma-separated key-value pairs.

The core defect is CWE-770: Allocation of Resources Without Limits or Throttling. The parser is supposed to honor two configuration directives:

• DD_TRACE_BAGGAGE_MAX_ITEMS — maximum number of baggage items accepted.
• DD_TRACE_BAGGAGE_MAX_BYTES — maximum total size of baggage payload.

Prior to 1.19.2, ddtrace_deserialize_baggage does not enforce either bound. Consequently:

1. A client may send a baggage header containing an arbitrarily large number of comma-separated key-value pairs; each pair results in a new hash-map entry, allowing an attacker to drive hash-map growth proportional to the supplied payload size.
2. Alternatively, a single oversized value is accepted without a byte cap.

In both cases the tracer invests CPU cycles in tokenizing, iterating, and inserting into its internal structures, and allocates memory for the growing map — all on a per-request basis. Since baggage extraction is enabled by default unless the operator has removed baggage from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, the vulnerable parsing path is reached automatically for normal inbound requests, with no authentication required.

This is an availability-only vulnerability: there is no evidence in the description of memory corruption, injection, or data disclosure. The absence of integrity/confidentiality impact (C:N/I:N) combined with high availability impact (A:H) and network attack vector (AV:N) yields the assigned CVSS 3.1 base score of 7.5. No public proof-of-concept, Nuclei template, or exploit code exists at time of writing; the attack chain is inferred from the vulnerability class and the authoritative NVD description.

Exploitation Scenarios

No public PoC is available; the following describes the attack at the vulnerability-class level, consistent with the NVD description. No function names, endpoints, or parameters beyond those stated in the source description are asserted.

1. Reconnaissance / target identification. The attacker identifies PHP applications instrumented with the Datadog PHP Tracer. Because ddtrace emits baggage-aware trace propagation by default and exposes tracing behavior through HTTP request handling, targets can be recognized by observing distributed-tracing behavior or by any prior knowledge that Datadog APM for PHP is in use. Exposure requires only that the application processes inbound HTTP requests (i.e., a public-facing web endpoint).

2. Triggering the flaw class. The attacker issues an HTTP request whose baggage header carries an abusive payload. Per the description, two variants exist:

   • Fan-out variant: an arbitrarily large number of comma-separated key-value pairs in a single baggage header, forcing allocation of one hash-map entry per pair.
   • Oversize variant: a single, arbitrarily large value that is accepted without a byte cap. In both cases the tracer's ddtrace_deserialize_baggage routine parses the header without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. Baggage extraction, being enabled by default, ensures the malicious header reaches the vulnerable parser.

3. Payload/execution method. The delivery mechanism is a standard crafted HTTP request header (the W3C baggage header). No authentication, session, or prior state is required (PR:N). Complexity is low (AC:L) and no user interaction is needed (UI:N). Successive or concurrent requests amplify the per-request CPU and memory cost.

4. Post-exploitation impact. Each malicious request causes unbounded CPU and memory consumption on the PHP process handling it. Because the cost is incurred per request, sustained or parallelized traffic can exhaust worker pools, saturate CPU, drive memory pressure/swap, and ultimately render the PHP application unavailable — a denial-of-service condition (A:H). No privilege escalation, code execution, or data exfiltration is indicated by the vulnerability description.

Impact Assessment

CVE-2026-50275 is an availability-impacting, remotely exploitable resource-exhaustion vulnerability. The CVSS 3.1 subscores are:

• Attack Vector (AV:N): exploitable over a network.
• Attack Complexity (AC:L): no special conditions; header crafting only.
• Privileges Required (PR:N): none — unauthenticated.
• User Interaction (UI:N): none.
• Scope (S:U): impact confined to the tracer's security authority.
• Confidentiality (C:N): no data exposure.
• Integrity (I:N): no data modification.
• Availability (A:H): high — unbounded CPU and memory consumption per request.

Business impact. Affected organizations are those running Datadog PHP Tracer versions prior to 1.19.2 in front of internet-facing PHP workloads, which is the common deployment for modern web/API services. Because baggage extraction is on by default, exposure is broad and requires no attacker preconditions. A sustained attack can degrade or take down instrumented services, affecting all downstream users of those applications. Blast radius is proportional to request volume and worker-pool sizing; horizontally scaled deployments face amplified aggregate resource pressure. There is no known exploit-in-the-wild or CISA KEV listing as of this writing, and EPSS is not yet scored, so immediate prioritization should be driven by internet exposure and the default-enabled nature of the vulnerable parser rather than observed exploitation.

Detection Guidance

Sigma Rule

title: Oversized or Excessive W3C Baggage Header (Datadog PHP Tracer DoS)
id: 7f2c1a10-2b3e-4d2f-9c1a-202650275abc
status: experimental
description: Detects HTTP requests carrying anomalous baggage headers consistent with CVE-2026-50275 resource exhaustion against ddtrace prior to 1.19.2.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-50275
author: ValtersIT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_baggage:
    cs-uri-query|contains: 'baggage='
  selection_header_size:
    cs-uri-query|re: '.{4096,}'
  selection_comma_fanin:
    cs-uri-query|re: '(?:[^,=]+=[^,]+){20,}'
  condition: selection_baggage and (selection_header_size or selection_comma_fanin)
fields:
  - c-ip
  - cs-method
  - cs-uri
falsepositives:
  - Legitimate trace propagation with many baggage items (rare)
level: medium

YARA Rule

rule CVE_2026_50275_Datadog_Baggage_Bomb
{
    meta:
        description = "Detects anomalous W3C baggage header payloads targeting Datadog PHP Tracer < 1.19.2"
        author = "ValtersIT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50275"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $baggage = "baggage:" ascii nocase
        $traceparent = "traceparent:" ascii nocase
    condition:
        filesize < 10MB and
        $baggage and
        for any i in (1..#baggage) : (
            // very long comma-separated key-value fan-out in the baggage line
            uint16be(0) == 0 and #traceparent >= 0
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-50275 Datadog PHP Tracer Baggage Header Resource Exhaustion Attempt"; flow:established,to_server; http.header; content:"baggage:"; nocase; http.header; pcre:"/(?:[^,=]+=[^,]+){20,}/i"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-dos; reference:cve,2026-50275; sid:202650275; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [http where http.request.headers.baggage != null and
        length(http.request.headers.baggage) > 4096]
  [http where http.request.headers.baggage != null and
        length(http.request.headers.baggage) > 4096]

Splunk SPL Query

index=web sourcetype=access_combined
| eval baggage_raw = coalesce(baggage, cs_header_baggage, cs_uri_query)
| where match(baggage_raw, "(?i)baggage=")
| eval baggage_len = len(baggage_raw)
| eval pair_count = mvcount(split(lower(baggage_raw), ","))
| where baggage_len > 4096 OR pair_count > 20
| stats count min(_time) as first_seen max(_time) as last_seen sum(baggage_len) as total_bytes by src_ip, uri
| where count >= 10
| sort - total_bytes

Wazuh OSSEC Rule

<group name="web,ddtrace,cve-2026-50275,">
  <rule id="2026502" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">baggage=</field>
    <regex type="pcre2">(?:[^,=]+=[^,]+){20,}</regex>
    <description>CVE-2026-50275: Excessive W3C baggage header detected (possible Datadog PHP Tracer DoS).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="2026503" level="10" frequency="10" timeframe="60">
    <if_matched_sid>2026502</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-50275: Repeated excessive baggage header requests from same source (DoS attempt).</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Remove baggage from propagation so the vulnerable parser path is not exercised: set the baggage style to be excluded from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT on all affected hosts. This directly avoids the vulnerable extraction routine per the NVD description.
   • Where baggage functionality is not required, disable it globally across the fleet to eliminate the attack surface.
   • Deploy an edge/WAF or reverse-proxy rule that rejects or truncates inbound baggage headers exceeding sane length and item-count thresholds, providing a compensating control until an upgrade is available.
   • Rate-limit and, where feasible, temporarily restrict public access to affected PHP endpoints.

2. Patch/upgrade steps.

   • Upgrade the Datadog PHP Tracer to version 1.19.2, in which the DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits are enforced by ddtrace_deserialize_baggage per the NVD description.
   • Because patch confidence is 0/4 and no vendor advisory has been confirmed, verify the fix against the upstream Datadog PHP Tracer release notes/vendor advisory before closing remediation. Where feasible, confirm on a staged host that oversized and high-cardinality baggage headers are now rejected or truncated.
   • After upgrade, optionally reinstate baggage propagation once you have validated the fix.

3. Long-term hardening.

   • Configure and monitor DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES to conservative values on all tracer deployments, and alert on any changes.
   • Enforce global inbound header size limits at the reverse proxy/load balancer tier to bound resource consumption regardless of application-library behavior.
   • Maintain a software-inventory process that tracks PHP tracer versions so unpatched builds can be identified and remediated promptly.
   • Continuously monitor for exploitation attempts using the detection content above.

References

• NVD — CVE-2026-50275: https://nvd.nist.gov/vuln/detail/CVE-2026-50275
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• Datadog PHP Tracer release notes / advisory (verify fixed version 1.19.2): https://github.com/DataDog/dd-trace-php/releases
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog (no listing for CVE-2026-50275 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: none observed; no public PoC, no Nuclei template, no exploit code, and no threat-actor campaign is associated with this CVE in the provided intelligence.