CVE-2026-50277

Executive Summary

CVE-2026-50277 is a resource exhaustion vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) in dd-trace-cpp, Datadog's distributed tracing library for C++. Versions prior to 2.1.0 fail to enforce configured baggage size and item-count limits (DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES) on the W3C baggage header extraction path, even though those same limits are enforced during injection.

This asymmetry allows a remote, unauthenticated attacker to send a single crafted baggage HTTP header — either containing many comma-separated key-value pairs or one abnormally large value — that triggers per-request hash-map allocation and unbounded CPU/memory consumption. Because baggage extraction is enabled by default in most affected tracers, any internet-facing service instrumented with a vulnerable dd-trace-cpp build can be denied service. CVSS v3.1 rates this 7.5 (High), with an Availability-only impact (A:H) and a network-reachable, low-complexity, no-privilege attack path.

Technical Analysis

The root cause is an enforcement gap between two symmetric code paths in the distributed tracing library: baggage injection (outbound) and baggage extraction (inbound). The NVD description states explicitly that dd-trace-cpp "parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection."

The two affected configuration parameters are:

• DD_TRACE_BAGGAGE_MAX_ITEMS — an upper bound on the number of distinct baggage items accepted from a header.
• DD_TRACE_BAGGAGE_MAX_BYTES — an upper bound on the total byte length of baggage data accepted.

These parameters are documented controls intended to constrain the work performed when parsing W3C-format baggage headers. W3C baggage is a list of comma-separated key=value members. On the extraction (server-side ingress) path, the tracer must:

1. Split the incoming header value on commas into individual members.
2. Parse each member into a key and a value.
3. Insert each parsed member into a per-request hash map (dictionary) so it can be propagated downstream and attached to spans.

When neither the item count nor the byte ceiling is checked before or during parsing, the cost of steps 1–3 becomes a direct function of attacker-controlled input size. Two distinct amplification patterns follow directly from the description:

• Many small members: a header consisting of a very large number of comma-separated k=v pairs forces a matching number of hash-map insertions. Even if each insertion is cheap, the aggregate allocation and hashing work scales linearly (and hash-table growth is super-linear at rehash boundaries) with the number of attacker-supplied members.
• One very large value: a single member with a multi-megabyte value forces allocation of a correspondingly large buffer/string and hash computation over that value.

In both cases the effect is described as "per-request hash-map allocation and unbounded CPU and memory consumption." Because HTTP servers maintain some degree of request concurrency, concurrent hostile requests compound the effect: allocated memory is not freed until each request completes, and parsing CPU is consumed synchronously in request-handling context.

Attack surface. The relevant surface is any HTTP endpoint that accepts request headers and is instrumented with a vulnerable dd-trace-cpp build, where baggage extraction is active. The description notes that "baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT." In other words, the vulnerable parser is reachable by default; disabling the capability requires explicit operator configuration rather than being opt-in.

Why the CVSS vector is scored as it is. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a purely availability-focused flaw. There is no confidentiality subscore (no disclosure of baggage contents to the attacker is claimed) and no integrity subscore (no claim of tampered trace context affecting downstream decisions). Exploitation is network-reachable, requires no authentication and no user interaction, and is low-complexity — a single malformed header is sufficient. The scope is Unchanged because the impact is confined to the vulnerable service's own resource pool.

No public exploitation artifacts. No PoC, exploit code, or Nuclei template is associated with this CVE in the provided data. The analysis above is derived strictly from the vulnerability class (unbounded resource allocation on an attacker-controlled parsing path) and the specific configuration parameters named verbatim in the NVD description. No HTTP endpoint names, function names, or file paths are asserted because none are present in the source material.

Exploitation Scenarios

The attack chain below is described at the vulnerability-class level. No public PoC exists; the chain is inferred from the described behavior and the CWE-770 classification.

1. Reconnaissance / target identification. An attacker identifies services that (a) expose HTTP endpoints to untrusted networks and (b) are instrumented with a vulnerable dd-trace-cpp build. Fingerprinting signals that may correlate with a target include the presence of Datadog tracing instrumentation in a service, response headers or error pages referencing the tracer, or the baggage header being echoed/consumed as part of downstream propagation. Because the vulnerable code path is a header parser, no application-specific endpoint knowledge is required — any endpoint that reaches the tracer's extraction logic is a candidate.

2. Triggering the flaw class. The attacker sends an HTTP request containing a baggage header crafted to exceed the bounds that the library fails to enforce on the extraction path. Two payload classes follow directly from the NVD description:

• Item-count exhaustion: a baggage header containing an extremely large number of comma-separated key=value members, driving one hash-map insertion per member.
• Byte-size exhaustion: a baggage header containing a single member with an excessively large value, driving allocation proportional to the value length.

Both are delivered as ordinary request headers and therefore require no authentication (PR:N) and no user interaction (UI:N).

3. Execution method. Parsing of the header is the exploitation primitive — there is no memory-corruption or injection step. The attacker's leverage is purely the cost imposed on the parser. The NVD description states the outcome is "per-request hash-map allocation and unbounded CPU and memory consumption." The attacker maximizes impact by (i) increasing payload size and/or member count, and (ii) issuing requests concurrently so that in-flight allocations and parsing work accumulate faster than they are reclaimed.

4. Post-exploitation impact. The observable result is denial of service: request latency rises, CPU saturation occurs on request-handling threads, memory grows with concurrent in-flight requests, and the service may become unresponsive or be killed by an out-of-memory condition. Because the flaw is Availability-only (C:N/I:N/A:H), no data exfiltration or state tampering is claimed. Recovery depends on the process surviving the load or being restarted; there is no persistent implant associated with this vulnerability class. The blast radius extends to any dependent service that synchronously calls the affected endpoint, potentially producing cascading timeouts across a trace-instrumented call graph.

Impact Assessment

Business impact centers on availability. An internet-facing service that uses a vulnerable dd-trace-cpp build with default baggage propagation enabled is exposed to a low-effort, unauthenticated denial-of-service condition. The CVSS v3.1 base score of 7.5 (High) decomposes as follows:

• AV:N (Network) — the baggage header is transmitted over the network; no local access is needed.
• AC:L (Low) — no special conditions or race windows are required; a single crafted header is conceptually sufficient.
• PR:N (None) — the attacker requires no credentials.
• UI:N (None) — no victim user action is needed.
• S:U (Unchanged) — impact remains within the vulnerable component's own security scope.
• C:N (None) — no confidentiality impact is described.
• I:N (None) — no integrity impact is described.
• A:H (High) — the description supports severe resource exhaustion ("unbounded CPU and memory consumption") leading to denial of service.

Affected systems. Any service written in C++ that embeds a dd-trace-cpp version prior to 2.1.0 and has baggage extraction enabled. Because the description states extraction is on by default in most affected tracers, exposure is the default posture rather than an opt-in risk.

Blast radius. Direct impact is localized to the vulnerable process (Unchanged scope), but practical blast radius can be larger: if the affected service is a shared ingress, API gateway, or a dependency of other services, saturating it can propagate latency and failures across the call graph. Trace-instrumented microservice architectures are particularly sensitive because failure of one hop degrades the observable performance of upstream callers.

Threat context. No EPSS score is available (not yet scored by FIRST.org), and there is no evidence of CISA KEV listing, exploit code, or public PoC in the provided data. The practical risk is driven by exposure (internet-facing, default-enabled parser) and low attack complexity rather than by observed exploitation. Absence of a public exploit does not meaningfully reduce risk here, because the technique — sending an oversized or item-dense header — requires no specialized tooling.

Detection Guidance

Detection should focus on anomalous baggage header characteristics at the network layer, on tracer parsing/resource-consumption behavior in application telemetry, and on correlated CPU/memory growth on instrumented hosts.

Sigma Rule

title: Potential dd-trace-cpp Baggage Extraction Resource Exhaustion (CVE-2026-50277)
id: 6f2b9c14-3a7e-4d21-9b0c-5e8a1f7d2c93
status: experimental
description: Detects HTTP requests carrying abnormally large or item-dense W3C baggage headers consistent with resource-exhaustion attempts against dd-trace-cpp < 2.1.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-50277
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: any
detection:
  selection_header:
    cs-header|contains: 'baggage'
  selection_toolarge:
    cs-header|re: '(?i)baggage:.{4096,}'
  selection_manyitems:
    cs-header|re: '(?i)baggage:([^=,]+=[^,]+,){50,}'
  condition: selection_header and (selection_toolarge or selection_manyitems)
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-header
falsepositives:
  - Legitimate upstream services that propagate unusually broad baggage context
level: medium
tags:
  - attack.t1190
  - cve.2026.50277

YARA Rule

rule CVE_2026_50277_ddtrace_baggage_exhaustion
{
    meta:
        description = "Detects HTTP request artifacts with oversized or item-dense W3C baggage headers targeting dd-trace-cpp < 2.1.0"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50277"
        date = "2026-01-01"
        severity = "high"

    strings:
        $hdr = "baggage:" ascii nocase
        $member = "=" ascii
        $sep = "," ascii

    condition:
        filesize < 50MB and
        $hdr and
        (
            #member > 50 or
            filesize > 8192
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-50277 dd-trace-cpp Baggage Extraction Resource Exhaustion Attempt"; flow:established,to_server; http.header; content:"baggage"; nocase; pcre:"/baggage:[^\r\n]{2048,}/i"; sid:9002771; rev:1; metadata:affected_product Datadog_dd-trace-cpp, cve CVE-2026-50277, attack_target Web_Server, deployment Perimeter, signature_severity Major, created_at 2026_01_01; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-50277; classtype:attempted-dos;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where http.request.method : "GET" or http.request.method : "POST" ]
  [ network where http.request.headers != null and
      length(http.request.headers) > 4096 ]

For environments that extract header names into ECS fields, an alternative rule targets the baggage header directly:

any where http.request.headers.baggage != null and
        length(http.request.headers.baggage) > 4096

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| eval baggage_len=len(baggage)
| eval item_count=if(baggage!="", mvcount(split(baggage, ",")), 0)
| where baggage_len > 4096 OR item_count > 50
| stats count AS suspicious_requests,
        avg(baggage_len) AS avg_baggage_bytes,
        max(item_count) AS max_items,
        dc(uri_path) AS distinct_paths
        BY src_ip, dest_host
| where suspicious_requests > 5
| sort - suspicious_requests
| table src_ip dest_host suspicious_requests avg_baggage_bytes max_items distinct_paths

Wazuh OSSEC Rule

<group name="web,dd-trace-cpp,CVE-2026-50277,">
  <rule id="100277" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>baggage:</match>
    <regex>baggage:[^\s]{4096,}</regex>
    <description>CVE-2026-50277: Oversized W3C baggage header in HTTP request - possible dd-trace-cpp resource exhaustion attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_50277,</group>
  </rule>

  <rule id="100278" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>baggage:</match>
    <regex type="pcre2">baggage:(?:[^=,\s]+=[^,]*,){50,}</regex>
    <description>CVE-2026-50277: Item-dense W3C baggage header in HTTP request - possible dd-trace-cpp resource exhaustion attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_50277,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note that the NVD description states the issue "is fixed in version 2.1.0," which is the upgrade target; however, no patch source, commit reference, or vendor advisory has been confirmed by tracked sources, and no workarounds were supplied. Treat the guidance below as defense-in-depth pending verification against the authoritative upstream release.

1. Immediate mitigations (apply now, before upgrading):

• Disable baggage extraction where it is not required. The description states the vulnerable parsing path is reached when baggage is included in propagation styles. Remove baggage from propagation by configuring DD_TRACE_PROPAGATION_STYLE and DD_TRACE_PROPAGATION_STYLE_EXTRACT so that the baggage extraction path is not exercised. This is the most direct way to remove attacker reach to the vulnerable parser.
• Constrain request header size at the edge. Front the affected service with a reverse proxy, load balancer, or WAF that enforces strict request-header size limits and, where possible, rejects or truncates baggage headers that exceed expected item counts or byte lengths. This mitigates the "one very large value" and "many comma-separated key-value pairs" patterns at the network boundary rather than in the tracer.
• Rate-limit and connection-cap. Apply per-source rate limiting and concurrent-connection caps on internet-facing endpoints to reduce the compounding effect of parallel hostile requests.
• Isolate the traced process. Run instrumented services with explicit memory limits and CPU quotas (e.g., container limits) so that an exhaustion attempt is contained and does not take down the host.

2. Patch / upgrade steps:

• Upgrade dd-trace-cpp to 2.1.0 or later, which the upstream description identifies as the fixed version. Because patch evidence is unconfirmed by tracked sources, verify the release notes and the changelog for the 2.1.0 tag directly in the upstream repository before relying on it.
• Rebuild and redeploy all C++ services that statically link or vendor dd-trace-cpp; a library upgrade requires recompilation and redeployment of dependent binaries.
• After upgrading, re-enable baggage propagation only if the operational requirement justifies it.
• Where the library is consumed transitively via a package manager or vendored dependency, update the dependency manifest and confirm the resolved version is >= 2.1.0.

3. Long-term hardening:

• Enforce symmetric limits. Treat inbound and outbound serialization paths as untrusted by default and apply the same size/count limits on both. Any configuration parameter that bounds outbound data should be validated as enforced inbound.
• Integrate header-size policy into code review. Add linting or test coverage that asserts limits are applied on the extraction path for all propagated context (baggage, traceparent, tracestate, and any custom propagators).
• Inventory tracing dependencies. Maintain a software bill of materials that records the exact dd-trace-cpp version per service so future advisories can be triaged quickly.
• Adopt default-deny propagation. Prefer explicitly allowing only the propagation styles an environment requires rather than inheriting tracer defaults.
• Monitor resource baselines. Alert on sustained CPU saturation and RSS growth correlated with request volume on instrumented services, so exhaustion attempts are detected even if the header itself is not logged.

References

• NVD — CVE-2026-50277: https://nvd.nist.gov/vuln/detail/CVE-2026-50277
• CWE-770: Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• Datadog dd-trace-cpp upstream repository (verify 2.1.0 release notes and changelog): https://github.com/DataDog/dd-trace-cpp
• W3C Baggage specification (header format and parsing expectations): https://www.w3.org/TR/baggage/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild status: No threat actor campaign, exploit-in-the-wild evidence, CISA KEV listing, public PoC, or Nuclei template is associated with CVE-2026-50277 in the available data. EPSS has not yet scored this CVE. Exploitation, if it occurs, is expected to be opportunistic and availability-focused rather than targeted or state-sponsored, consistent with the resource-exhaustion vulnerability class.