# CVE-2026-50276: Datadog dd-trace-rb denial of service in W3C baggage parsing

Source: https://junglewise.ai/threats/cve-2026-50276-datadog-dd-trace-rb-denial-of-service-in-w3c-baggage-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-50276 · Severity: high · CVSS 7.5 · Published 2026-09-14

Datadog's Ruby tracing library, used to monitor application performance, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send specially crafted web requests that cause the application to consume excessive CPU and memory. This can lead to application crashes or significant performance degradation, making the service unavailable to legitimate users.

Vendors: [Datadog](https://junglewise.ai/threats/vendors/datadog), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-50276 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50276 being exploited in the wild.

**How severe is CVE-2026-50276?** High severity, with a CVSS score of 7.5, published 14 September 2026.

**Which products and versions are affected?** Datadog Dd-Trace-Rb < 2.32.0; datadog (RubyGems) ECOSYSTEM:introduced=0,fixed=2.32.0.

**Is there a fix for CVE-2026-50276?** Yes. datadog (RubyGems): upgrade to 2.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50276 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50276?** Check whether you run Datadog Dd-Trace-Rb or datadog (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- datadog (RubyGems): upgrade to 2.32.0 or later

  ```sh
  bundle update datadog
  ```


## Technical details

The Datadog tracing library for Ruby (dd-trace-rb) fails to enforce item-count or byte-size limits when extracting W3C baggage headers from incoming HTTP requests. While limits existed for baggage injection, the extraction path lacked these checks, allowing a remote, unauthenticated attacker to provide an arbitrarily large number of comma-separated key-value pairs. The tracer allocates a hash-map entry for every pair, leading to unbounded resource consumption (CWE-400, CWE-770). This vulnerability is exploitable by default in instrumented applications unless the baggage propagation style has been explicitly disabled. The issue is resolved in version 2.32.0.

## Affected products

- Datadog dd-trace-rb < 2.32.0

## Identifiers

- CVE-2026-50276
- GHSA-p5f6-rccc-jv98

## Timeline

- 2026-06-05: disclosed: Initial publication by DataDog
- 2026-06-05: patched: Version 2.32.0 released
- 2026-07-15: advisory: GitHub Advisory published

## References

- [https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98](https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98)
- [https://api.github.com/repos/DataDog/dd-trace-rb/security-advisories/GHSA-p5f6-rccc-jv98](https://api.github.com/repos/DataDog/dd-trace-rb/security-advisories/GHSA-p5f6-rccc-jv98)