CVE-2026-50270: dd-trace-java Baggage Extraction DoS Flaw

CVE-2026-50270 Overview

CVE-2026-50270 is a denial of service vulnerability in dd-trace-java, the Datadog Application Performance Monitoring (APM) client for Java. The flaw affects all versions prior to 1.62.0. The W3C baggage HTTP header extraction path does not enforce the DD_TRACE_BAGGAGE_MAX_ITEMS limit (default 64) or the DD_TRACE_BAGGAGE_MAX_BYTES limit (default 8192), although both limits apply during baggage injection. A remote, unauthenticated attacker can submit a crafted baggage header on any HTTP request to trigger unbounded CPU and memory consumption. The vulnerability is categorized as Allocation of Resources Without Limits or Throttling [CWE-770].

Critical Impact
Any HTTP service instrumented with a vulnerable dd-trace-java tracer using the default baggage propagation style can be crashed by a single unauthenticated attacker sending oversized baggage headers.

Affected Products

Datadog dd-trace-java versions prior to 1.62.0
Java HTTP services instrumented with the affected tracer
Deployments using the default baggage propagation style

Discovery Timeline

2026-09-14 - CVE-2026-50270 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-50270

Vulnerability Analysis

The vulnerability resides in the baggage extraction logic of dd-trace-java. The W3C baggage HTTP header carries comma-separated key-value pairs used for distributed context propagation. When an incoming request arrives, the tracer parses this header and allocates map entries for each pair. The extraction path does not consult the configured item count or byte size ceilings, so parsing continues until the header is exhausted. An attacker can therefore control both the number of allocations and the size of each allocated value per request.

Because the baggage propagation style is enabled by default for most affected tracers, every instrumented HTTP endpoint becomes an amplification surface. Sustained request rates convert modest attacker bandwidth into unbounded heap growth and CPU work parsing malformed input.

Root Cause

The root cause is missing enforcement of DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES in the extraction routine within BaggagePropagator.java. These limits were only applied on the injection path, leaving the ingress side without bounds checking [CWE-770].

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends an HTTP request containing a baggage header populated with either thousands of comma-separated key-value pairs or a single very large value. Repeated requests exhaust CPU and heap memory, causing service degradation or a full crash.

java

// Source: https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757
// Security patch in dd-trace-core/src/main/java/datadog/trace/core/baggage/BaggagePropagator.java
 package datadog.trace.core.baggage;

-import static java.util.Collections.emptyMap;
-
 import datadog.context.Context;
 import datadog.context.propagation.CarrierSetter;
 import datadog.context.propagation.CarrierVisitor;

The full patch in Pull Request 11265 adds enforcement of the item-count and byte-size limits during header extraction so that parsing stops once either threshold is reached.

Detection Methods for CVE-2026-50270

Indicators of Compromise

Inbound HTTP requests containing baggage headers larger than 8192 bytes or with more than 64 comma-separated key-value pairs.
Sudden Java Virtual Machine (JVM) heap growth and CPU saturation on services running dd-trace-java prior to 1.62.0.
OutOfMemoryError events or long garbage collection pauses correlated with spikes in incoming request volume.

Detection Strategies

Inspect web server, reverse proxy, and load balancer access logs for oversized baggage header values against Java services.
Correlate JVM memory and CPU telemetry with request rates carrying non-empty baggage headers.
Deploy Web Application Firewall (WAF) rules that flag baggage headers exceeding vendor-documented default limits.

Monitoring Recommendations

Track heap usage, garbage collection frequency, and thread CPU time on all Java services using dd-trace-java.
Alert on HTTP 5xx spikes coincident with unusual baggage header sizes from single source IPs.
Retain HTTP request header metadata in centralized logging to support post-incident forensics.

How to Mitigate CVE-2026-50270

Immediate Actions Required

Upgrade dd-trace-java to version 1.62.0 or later across all Java services.
Inventory all applications embedding the Datadog APM client to confirm patch coverage.
Deploy upstream WAF or reverse proxy rules to drop requests carrying oversized baggage headers until patching completes.

Patch Information

The fix is available in dd-trace-java release v1.62.0 and merged via Pull Request 11265. Details are documented in GitHub Security Advisory GHSA-74xj-wh4w-vqxc.

Workarounds

Disable the baggage propagation style in the tracer configuration if it is not required by the application.
Enforce maximum header size limits at the reverse proxy or ingress controller to strip or reject oversized baggage headers.
Apply rate limiting on unauthenticated endpoints to reduce amplification potential while patching is in progress.

bash

# Example: strip oversized baggage headers at an NGINX ingress
# Reject requests where the baggage header exceeds 8192 bytes
if ($http_baggage ~* ".{8193,}") {
    return 400;
}