Is CVE-2026-50276 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50276 being exploited in the wild.

How severe is CVE-2026-50276?

High severity, with a CVSS score of 7.5, published 14 September 2026.

Which products and versions are affected?

Datadog Dd-Trace-Rb < 2.32.0; datadog (RubyGems) ECOSYSTEM:introduced=0,fixed=2.32.0.

Is there a fix for CVE-2026-50276?

Yes. datadog (RubyGems): upgrade to 2.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50276 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50276?

Check whether you run Datadog Dd-Trace-Rb or datadog (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50276: Datadog dd-trace-rb denial of service in W3C baggage parsing

Q: Which products and versions are affected?

Datadog Dd-Trace-Rb < 2.32.0; datadog (RubyGems) ECOSYSTEM:introduced=0,fixed=2.32.0.

Q: Is there a fix for CVE-2026-50276?

Yes. datadog (RubyGems): upgrade to 2.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50276 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-50276?

Check whether you run Datadog Dd-Trace-Rb or datadog (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50276 · Severity: high · CVSS 7.5 · Published 2026-09-14

Datadog's Ruby tracing library, used to monitor application performance, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send specially crafted web requests that cause the application to consume excessive CPU and memory. This can lead to application crashes or significant performance degradation, making the service unavailable to legitimate users.

Vendors: Datadog, RubyGems.

Quick answers

Is CVE-2026-50276 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50276 being exploited in the wild.
How severe is CVE-2026-50276?: High severity, with a CVSS score of 7.5, published 14 September 2026.
Which products and versions are affected?: Datadog Dd-Trace-Rb < 2.32.0; datadog (RubyGems) ECOSYSTEM:introduced=0,fixed=2.32.0.
Is there a fix for CVE-2026-50276?: Yes. datadog (RubyGems): upgrade to 2.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50276 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50276?: Check whether you run Datadog Dd-Trace-Rb or datadog (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

datadog (RubyGems): upgrade to 2.32.0 or later
```
bundle update datadog
```

Technical details

The Datadog tracing library for Ruby (dd-trace-rb) fails to enforce item-count or byte-size limits when extracting W3C baggage headers from incoming HTTP requests. While limits existed for baggage injection, the extraction path lacked these checks, allowing a remote, unauthenticated attacker to provide an arbitrarily large number of comma-separated key-value pairs. The tracer allocates a hash-map entry for every pair, leading to unbounded resource consumption (CWE-400, CWE-770). This vulnerability is exploitable by default in instrumented applications unless the baggage propagation style has been explicitly disabled. The issue is resolved in version 2.32.0.

Affected products

Datadog dd-trace-rb < 2.32.0

Identifiers

CVE-2026-50276
GHSA-p5f6-rccc-jv98

Timeline

2026-06-05: disclosed: Initial publication by DataDog
2026-06-05: patched: Version 2.32.0 released
2026-07-15: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.