CVE-2026-50276

Executive Summary

CVE-2026-50276 is a denial-of-service vulnerability in dd-trace-rb, Datadog's distributed tracing client library for Ruby, affecting versions prior to 2.32.0. The flaw allows a remote, unauthenticated attacker to send a crafted W3C baggage HTTP header that is parsed without enforcing the configured item-count (DD_TRACE_BAGGAGE_MAX_ITEMS, default 64) or byte-size (DD_TRACE_BAGGAGE_MAX_BYTES, default 8192) limits on the extraction path, causing unbounded CPU and memory consumption on every request. Any Ruby HTTP service that has W3C baggage propagation enabled — the default for most affected tracer configurations — is exposed to resource-exhaustion denial of service, with a CVSS base score of 7.5 (High).

Technical Analysis

dd-trace-rb implements the W3C baggage propagation format, which carries arbitrary key-value pairs across distributed service boundaries via an HTTP header. The library exposes two configuration controls intended to bound the resources spent processing these headers:

• DD_TRACE_BAGGAGE_MAX_ITEMS — maximum number of baggage entries, default 64.
• DD_TRACE_BAGGAGE_MAX_BYTES — maximum size of the baggage payload, default 8192 bytes.

According to the NVD description, these limits are enforced during baggage injection (outbound propagation) but are not enforced during baggage extraction (inbound parsing). The extraction path allocates an in-memory entry for each parsed key-value pair while processing the attacker-controlled header. Because W3C baggage is a comma-separated list of key-value pairs, an attacker can supply either:

1. A header containing an extremely large number of comma-separated pairs, forcing a large number of per-entry allocations, or
2. A single very large value, forcing allocation of a very large buffer.

In both cases the vulnerable code performs work proportional to the size and cardinality of the attacker-supplied input rather than to the configured limits, resulting in unbounded CPU consumption (parsing) and memory consumption (allocation). The defect maps to CWE-770 (Allocation of Resources Without Limits or Throttling).

Because the baggage propagation style is enabled by default in "most affected tracers," the vulnerable extraction routine is reached on ordinary inbound HTTP requests that carry a baggage header. No authentication, user interaction, or special network position is required — only the ability to send HTTP requests to a service running an affected dd-trace-rb version. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects exactly this profile: network-reachable, low attack complexity, no privileges, no user interaction, no confidentiality or integrity impact, and high availability impact.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is known for CVE-2026-50276 at the time of writing; the following chain is inferred from the vulnerability class (uncontrolled resource consumption) and the mechanics described in the NVD entry.

1. Reconnaissance / target identification. The attacker identifies a Ruby-based HTTP service that uses Datadog tracing with W3C baggage propagation enabled. Because baggage propagation is the default for most affected tracer configurations, and because the library is widely embedded in Ruby web frameworks, the attacker can probe candidate endpoints by sending ordinary requests and observing whether injected baggage/trace headers are echoed or propagated (e.g., in trace context). Passive discovery can also rely on identifying Ruby/Rack services through response headers and banners.

2. Triggering the specific flaw class. The attacker sends an HTTP request containing a baggage header whose value is engineered so that parsing allocates far beyond the configured limits. Two variants are possible per the advisory: (a) a header containing a very large number of comma-separated key-value pairs, exceeding the intended 64-item ceiling, or (b) a header containing a single very large value, exceeding the intended 8192-byte ceiling. In both variants the extraction path allocates entries while parsing, and no limit check interrupts the work.

3. Payload / execution method (class level). This is a resource-exhaustion attack: the "payload" is the oversized or high-cardinality header value itself, delivered as an ordinary HTTP request. The attacker does not need to bypass authentication or craft a memory-corruption primitive; the vulnerable parsing logic simply performs unbounded work on attacker-controlled input. Concurrency or repetition across requests amplifies the per-request cost by consuming additional CPU cycles and heap memory, degrading throughput and latency and potentially triggering OOM conditions in the Ruby process or container.

4. Post-exploitation impact. Successful exploitation results in denial of service: request latency increases, worker/thread pools saturate, memory grows unbounded, and the service may become unresponsive or be killed by the container runtime or OOM killer. Because the flaw affects the inbound request path, all tenants and users of the affected service are impacted (scope unchanged per CVSS). No data confidentiality or integrity impact is described.

Impact Assessment

The CVSS base score is 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Subscore interpretation:

• Availability impact — High (A:H): the primary and only impacted security property. Resource exhaustion can render the tracer-enabled HTTP service unavailable.
• Confidentiality (C:N) and Integrity (I:N): no impact described.
• Attack Vector — Network (AV:N), Attack Complexity — Low (AC:L): the attacker only needs to send HTTP requests carrying a crafted header.
• Privileges Required — None (PR:N), User Interaction — None (UI:N): the vulnerability is reachable pre-authentication; no victim action is required.
• Scope — Unchanged (S:U): impact is confined to the vulnerable service's own resources.
• EPSS: 0.00793 (54.4th percentile), indicating low near-term exploitation likelihood based on current telemetry — consistent with the absence of public PoC. This should not be treated as a reason to deprioritize remediation, as the barrier to exploitation is minimal and the impact on availability is high for internet-exposed services.

Affected systems: Ruby applications and services that depend on dd-trace-rb < 2.32.0 and operate with W3C baggage propagation enabled (the default in most affected tracer configurations). This includes web applications, API gateways, and microservices embedded in Rack-based stacks. Blast radius: any endpoint that processes inbound baggage headers can be used to consume resources; a single exposed service instance can be degraded by repeated requests, and horizontally scaled deployments can be targeted in aggregate.

Detection Guidance

Sigma Rule

title: Potential dd-trace-rb W3C Baggage Resource Exhaustion (CVE-2026-50276)
id: 5b1f1c2a-9e6d-4a3b-8c7d-1f0e2d3c4b5a
status: experimental
description: Detects HTTP requests carrying oversized or high-cardinality W3C baggage headers targeting Ruby services using affected dd-trace-rb versions.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-50276
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_baggage:
    cs-header|contains:
      - 'baggage:'
      - 'Baggage:'
  filter_large:
    len: '>8192'
  filter_many_items:
    cs-header|re: '(baggage|Baggage):\s*([^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+)'
  condition: selection_baggage and (filter_large or filter_many_items)
falsepositives:
  - Legitimate high-cardinality baggage in complex microservice topologies
level: medium

YARA Rule

rule CVE_2026_50276_Baggage_Oversize
{
    meta:
        author = "valtersit.com"
        description = "Detects oversized W3C baggage headers in HTTP request captures targeting dd-trace-rb (CVE-2026-50276)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50276"
        date = "2026-01-01"
        severity = "high"
    strings:
        $baggage = /[Bb]aggage:\s/
        $comma = ","
    condition:
        $baggage and #comma > 64
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-50276 dd-trace-rb W3C Baggage Extraction Resource Exhaustion Attempt"; flow:established,to_server; http.header; content:"baggage"; nocase; pcre:"/[Bb]aggage:\s*[^\r\n]{8193,}/R"; threshold:type both, track by_src, count 5, seconds 10; classtype:attempted-dos; sid:202650276; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [http where http.request.headers contains "baggage"]
  [http where http.request.headers contains "baggage" and length(http.request.headers) > 8192]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=httplog
| eval bag=lower(coalesce(baggage_header, cs_headers_baggage, ""))
| where len(bag) > 8192 OR (mvcount(split(bag, ",")) > 64)
| stats count values(bag) as baggage_samples by src_ip, uri_path, dest_host
| where count >= 5
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-50276,">
  <rule id="2026501" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <field name="baggage">\.</field>
    <description>CVE-2026-50276: HTTP request with W3C baggage header observed (potential resource exhaustion attempt)</description>
  </rule>
  <rule id="2026502" level="12">
    <if_sid>2026501</if_sid>
    <field name="url" type="pcre2">[Bb]aggage:.{8192,}</field>
    <description>CVE-2026-50276: Oversized W3C baggage header detected - dd-trace-rb extraction resource exhaustion</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed). The GitHub Security Advisory (GHSA) states the issue is fixed in dd-trace-rb 2.32.0. No vendor-provided workaround is documented in the supplied data.

1. Immediate mitigations

   • Upgrade dd-trace-rb to 2.32.0 or later as the definitive fix where feasible.
   • If immediate upgrade is not possible, reduce exposure by disabling W3C baggage propagation where it is not operationally required, or restricting which inbound headers are forwarded to the tracer.
   • Front services with edge controls that reject or truncate oversized HTTP headers and limit the cardinality/length of baggage header values before they reach the application.
   • Apply rate limiting and connection limits at the reverse proxy / load balancer / WAF layer to blunt resource-exhaustion bursts, and monitor Ruby process heap and worker saturation.

2. Patch / upgrade steps

   • Identify all Ruby applications and transitive dependencies that resolve dd-trace-rb versions < 2.32.0 (inspect Gemfile.lock, bundle metadata, and container images).
   • Update the gem to >= 2.32.0, run the regression suite, and redeploy.
   • Validate post-upgrade that the extraction path honors DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES by testing with oversized/high-cardinality baggage headers in a non-production environment.
   • Because patch confidence is only CLAIMED (single source, GHSA), independently verify fix behavior before relying solely on the advisory.

3. Long-term hardening

   • Enforce input-size limits at the perimeter (header count, per-header byte size) as defense-in-depth, independent of library-level limits.
   • Monitor upstream advisories for dd-trace-rb and related Datadog tracers; maintain an SBOM and continuous dependency scanning.
   • Instrument resource-consumption SLOs (CPU, heap, request latency) with alerting on abnormal growth correlated with inbound propagation headers.

References

• NVD — CVE-2026-50276: https://nvd.nist.gov/vuln/detail/CVE-2026-50276
• GitHub Security Advisory (GHSA) — dd-trace-rb W3C baggage extraction resource exhaustion, fixed in 2.32.0
• Datadog dd-trace-rb project repository and release/changelog notes for version 2.32.0
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• CISA KEV Catalog: CVE-2026-50276 is NOT listed as of this writing; no known exploitation in the wild, no public PoC, and no attributed threat actor campaigns are documented in the provided intelligence.