Executive brief
Datadog's Ruby tracing library, used to monitor application performance, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send specially crafted web requests that cause the application to consume excessive CPU and memory. This can lead to application crashes or significant performance degradation, making the service unavailable to legitimate users.
Technical details
The Datadog tracing library for Ruby (dd-trace-rb) fails to enforce item-count or byte-size limits when extracting W3C baggage headers from incoming HTTP requests. While limits existed for baggage injection, the extraction path lacked these checks, allowing a remote, unauthenticated attacker to provide an arbitrarily large number of comma-separated key-value pairs. The tracer allocates a hash-map entry for every pair, leading to unbounded resource consumption (CWE-400, CWE-770). This vulnerability is exploitable by default in instrumented applications unless the baggage propagation style has been explicitly disabled. The issue is resolved in version 2.32.0.
Affected products
- Datadog dd-trace-rb < 2.32.0
Timeline
- 2026-06-05: disclosed: Initial publication by DataDog
- 2026-06-05: patched: Version 2.32.0 released
- 2026-07-15: advisory: GitHub Advisory published