Unbounded Resource Consumption in Datadog's Ruby Client Library

CVE-2026-50276

What is CVE-2026-50276?

In the Datadog dd-trace-rb client library for Ruby, a vulnerability exists in the baggage extraction mechanism prior to version 2.32.0. This issue allows a remote unauthenticated attacker to craft a baggage HTTP header with a plethora of key-value pairs or a sizable single value, overrunning the DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits, which are only enforced during baggage injection. The parsing of this attacker-controlled header during each request can lead to unbounded CPU and memory usage in an HTTP service when baggage propagation is enabled. This behavior may ultimately culminate in denial of service for affected systems. To address this issue, users are advised to upgrade to version 2.32.0 or later.

References