CVE-2026-50270: dd-java-agent baggage header parsing

CISO Take

Datadog's Java APM tracer fails to enforce its own configured limits (64 items / 8192 bytes) when parsing the W3C baggage HTTP header on incoming requests, so a remote unauthenticated attacker can send a single request with an oversized or highly fragmented baggage header and force unbounded CPU and memory allocation on every hit. This is a CVSS 7.5 network-exploitable DoS with no authentication or user interaction required, and baggage propagation is enabled by default in most affected tracer configurations, meaning any Java service instrumented with dd-trace-java for observability is exposed without extra configuration. There is no EPSS score, no CISA KEV listing, and no public exploit or scanner template yet, so this looks like a fresh advisory rather than something actively weaponized in the wild — but the attack is trivial to construct once a target is identified, since it only requires crafting a header value. For any AI/ML backend written in Java (model-serving APIs, LLM gateways, agent orchestration services) that ships APM via dd-trace-java, patch to 1.62.0 immediately; if immediate patching isn't possible, disable or restrict the W3C baggage propagation style and add a reverse-proxy/WAF rule capping header size and comma-separated entry count as a stopgap.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium-high operational risk despite the high CVSS score: impact is confined to availability (C:N/I:N/A:H), attack complexity is low, and no privileges or user interaction are needed, making this trivially exploitable by any remote actor who can reach the HTTP listener. The absence of an EPSS score, KEV listing, or public PoC suggests exploitation is not yet observed, but the simplicity of the attack (a single crafted header) means that could change quickly once the advisory circulates. The real-world risk is proportional to how much of an organization's AI-facing Java infrastructure has baggage propagation enabled by default, which the advisory states is the common case.

How does the attack unfold?

Target identification

Attacker identifies a Java-based AI-facing HTTP service instrumented with a pre-1.62.0 dd-trace-java agent with baggage propagation enabled.

AML.T0006

Malicious header crafting

Attacker crafts an HTTP request with a baggage header containing thousands of key-value pairs or one very large value to maximize parsing cost.

AML.T0034.001

Resource exhaustion

The tracer's extraction path allocates map entries without enforcing configured item/byte limits, consuming excessive CPU and memory per request.

Denial of service

Repeated or sustained malicious requests exhaust host resources, degrading or crashing the AI service and denying access to legitimate users and downstream agents.

AML.T0029

Target identification

Attacker identifies a Java-based AI-facing HTTP service instrumented with a pre-1.62.0 dd-trace-java agent with baggage propagation enabled.

AML.T0006

Malicious header crafting

Attacker crafts an HTTP request with a baggage header containing thousands of key-value pairs or one very large value to maximize parsing cost.

AML.T0034.001

Resource exhaustion

The tracer's extraction path allocates map entries without enforcing configured item/byte limits, consuming excessive CPU and memory per request.

Denial of service

Repeated or sustained malicious requests exhaust host resources, degrading or crashing the AI service and denying access to legitimate users and downstream agents.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
dd-java-agent	—	—	No patch
dd-trace-java	—	—	No patch

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Upgrade dd-trace-java (and dd-java-agent) to 1.62.0 or later, which enforces DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) on extraction as well as injection. If immediate patching is not feasible, disable W3C baggage propagation (remove 'baggage' from the configured propagation styles) or restrict it at the edge. As a stopgap, enforce a reverse-proxy/WAF rule capping the baggage header's byte length and comma-separated entry count before it reaches the JVM. For detection, monitor for anomalous CPU/memory spikes correlated with large or high-cardinality baggage headers in access logs, and alert on repeated requests from a single source carrying oversized baggage values.

How is it classified?

DoS API AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system operation and monitoring

NIST AI RMF

MANAGE-4.1 - Risk treatment and monitoring of deployed AI systems

OWASP LLM Top 10

LLM10 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-50270?

Datadog's Java APM tracer fails to enforce its own configured limits (64 items / 8192 bytes) when parsing the W3C baggage HTTP header on incoming requests, so a remote unauthenticated attacker can send a single request with an oversized or highly fragmented baggage header and force unbounded CPU and memory allocation on every hit. This is a CVSS 7.5 network-exploitable DoS with no authentication or user interaction required, and baggage propagation is enabled by default in most affected tracer configurations, meaning any Java service instrumented with dd-trace-java for observability is exposed without extra configuration. There is no EPSS score, no CISA KEV listing, and no public exploit or scanner template yet, so this looks like a fresh advisory rather than something actively weaponized in the wild — but the attack is trivial to construct once a target is identified, since it only requires crafting a header value. For any AI/ML backend written in Java (model-serving APIs, LLM gateways, agent orchestration services) that ships APM via dd-trace-java, patch to 1.62.0 immediately; if immediate patching isn't possible, disable or restrict the W3C baggage propagation style and add a reverse-proxy/WAF rule capping header size and comma-separated entry count as a stopgap.

Is CVE-2026-50270 actively exploited?

No confirmed active exploitation of CVE-2026-50270 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-50270?

Upgrade dd-trace-java (and dd-java-agent) to 1.62.0 or later, which enforces DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) on extraction as well as injection. If immediate patching is not feasible, disable W3C baggage propagation (remove 'baggage' from the configured propagation styles) or restrict it at the edge. As a stopgap, enforce a reverse-proxy/WAF rule capping the baggage header's byte length and comma-separated entry count before it reaches the JVM. For detection, monitor for anomalous CPU/memory spikes correlated with large or high-cardinality baggage headers in access logs, and alert on repeated requests from a single source carrying oversized baggage values.

What systems are affected by CVE-2026-50270?

This vulnerability affects the following AI/ML architecture patterns: model serving, agent frameworks, rag.

What is the CVSS score for CVE-2026-50270?

CVE-2026-50270 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.56%.

What is the AI security impact?

Affected AI Architectures

model servingagent frameworksrag

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0.

Exploitation Scenario

An attacker identifies a Java-based AI inference API, agent backend, or RAG service instrumented with a pre-1.62.0 dd-trace-java agent (visible via response headers, timing side-channels, or simply by targeting known Java AI-stack deployments). The attacker crafts an HTTP request to the service's public endpoint with a baggage header containing thousands of comma-separated key-value pairs, or a single very large value, and floods the endpoint with these requests. Each request forces the tracer to allocate map entries unbounded by the configured limits, exhausting CPU and memory on the host and degrading or crashing the AI service — denying legitimate users and downstream agents access to model inference or retrieval functionality without needing any credentials.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.