---
id: CVE-2026-50276
title: dd-trace-rb is Datadog's client library for Ruby
summary: >-
  dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage
  extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64,
  or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits
  app…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
  - CWE-400
vendor: DataDog
product: dd-trace-rb
affected:
  - dd-trace-rb < 2.32.0
patched:
  - datadog 2.32.0
published: '2026-09-14'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T14:10:13.927'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50276'
references:
  - url: >-
      https://github.com/DataDog/dd-trace-rb/commit/361947090214488778ac4f144e219426ffcf92e6
    label: security-advisories@github.com
  - url: 'https://github.com/DataDog/dd-trace-rb/pull/5672'
    label: security-advisories@github.com
  - url: 'https://github.com/DataDog/dd-trace-rb/releases/tag/v2.32.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-p5f6-rccc-jv98'
tags:
  - nvd
  - cve.org
  - ghsa
  - rubygems
epss: 0.00793
epssPercentile: 0.54494
aliases:
  - GHSA-p5f6-rccc-jv98
ecosystem: rubygems
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T17:37:49.381563Z'
ingestedAt: '2026-07-15T23:47:19.101Z'
---

## Overview

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 2.32.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-50276)

Affected packages:

- `datadog < 2.32.0`

Patched in:

- `datadog 2.32.0`

Source: https://github.com/advisories/GHSA-p5f6-rccc-jv98