CVE-2026-50272: unbounded W3C baggage parsing enables

CISO Take

dd-trace, Datadog's Node.js APM client, fails to enforce its own DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits when parsing incoming W3C baggage headers, so a single unauthenticated HTTP request with thousands of comma-separated key-value pairs — or one oversized value — can exhaust CPU and memory on any service that has baggage propagation enabled. There is no EPSS data yet, it is not in CISA KEV, and no public exploit or scanner template exists, but the attack requires no privileges, no user interaction, and low complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), meaning any attacker who can reach an instrumented HTTP endpoint can trivially trigger it once the mechanics are known. Because dd-trace instruments observability for a broad swath of production services — including AI inference APIs, agent orchestration layers, and RAG backends — a successful exploit degrades availability of whatever it's attached to, not the AI logic itself. Upgrade to dd-trace 5.100.0 or later immediately; until patched, disable baggage extraction (remove baggage from DD_TRACE_PROPAGATION_STYLE_EXTRACT) and add a reverse-proxy/WAF header-size cap as a stopgap, then watch for CPU spikes correlated with anomalously large baggage headers in access logs.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Classic unbounded-resource-consumption (CWE-770) DoS with a low bar to exploit: no auth, no user interaction, low attack complexity, remotely triggerable with a single crafted header. Impact is confidentiality/integrity-neutral (CVSS C:N/I:N) but availability-severe (A:H). Absence from CISA KEV and lack of EPSS/public exploit data indicate no known active exploitation yet, but the simplicity of the trigger (a plain HTTP header) means exploit development requires no specialized skill — sophistication is trivial. Real-world risk is gated entirely by whether baggage propagation is enabled in a given deployment; environments with it on are exposed the moment the service is internet-facing.

How does the attack unfold?

Initial access

Attacker sends an unauthenticated HTTP request to any public-facing endpoint of a service instrumented with a vulnerable dd-trace version.

AML.T0049

Exploitation

The request's W3C baggage header contains an excessive number of comma-separated key-value pairs or one very large value; dd-trace parses it without enforcing configured item/byte limits.

Impact

Unbounded parsing consumes CPU and memory, degrading or crashing the service and any AI inference, agent, or RAG functionality running behind it.

AML.T0029

Initial access

Attacker sends an unauthenticated HTTP request to any public-facing endpoint of a service instrumented with a vulnerable dd-trace version.

AML.T0049

Exploitation

The request's W3C baggage header contains an excessive number of comma-separated key-value pairs or one very large value; dd-trace parses it without enforcing configured item/byte limits.

Impact

Unbounded parsing consumes CPU and memory, degrading or crashing the service and any AI inference, agent, or RAG functionality running behind it.

AML.T0029

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

1) Upgrade dd-trace to 5.100.0 or later, where DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES are properly enforced on extraction. 2) Interim workaround: remove 'baggage' from DD_TRACE_PROPAGATION_STYLE_EXTRACT (or the equivalent propagation-style config) to disable baggage header parsing entirely until patched. 3) Add a request header size limit at the reverse proxy/load balancer (nginx, Envoy, CDN/WAF) as defense-in-depth against oversized headers generally. 4) Detection: alert on CPU/memory spikes correlated with unusually large or high-cardinality baggage headers in access/APM logs; monitor for sudden latency degradation on services with tracing enabled.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS API AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.4 - AI system operation and monitoring

OWASP LLM Top 10

LLM10 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-50272?

dd-trace, Datadog's Node.js APM client, fails to enforce its own DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits when parsing incoming W3C baggage headers, so a single unauthenticated HTTP request with thousands of comma-separated key-value pairs — or one oversized value — can exhaust CPU and memory on any service that has baggage propagation enabled. There is no EPSS data yet, it is not in CISA KEV, and no public exploit or scanner template exists, but the attack requires no privileges, no user interaction, and low complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), meaning any attacker who can reach an instrumented HTTP endpoint can trivially trigger it once the mechanics are known. Because dd-trace instruments observability for a broad swath of production services — including AI inference APIs, agent orchestration layers, and RAG backends — a successful exploit degrades availability of whatever it's attached to, not the AI logic itself. Upgrade to dd-trace 5.100.0 or later immediately; until patched, disable baggage extraction (remove baggage from DD_TRACE_PROPAGATION_STYLE_EXTRACT) and add a reverse-proxy/WAF header-size cap as a stopgap, then watch for CPU spikes correlated with anomalously large baggage headers in access logs.

Is CVE-2026-50272 actively exploited?

No confirmed active exploitation of CVE-2026-50272 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-50272?

1) Upgrade dd-trace to 5.100.0 or later, where DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES are properly enforced on extraction. 2) Interim workaround: remove 'baggage' from DD_TRACE_PROPAGATION_STYLE_EXTRACT (or the equivalent propagation-style config) to disable baggage header parsing entirely until patched. 3) Add a request header size limit at the reverse proxy/load balancer (nginx, Envoy, CDN/WAF) as defense-in-depth against oversized headers generally. 4) Detection: alert on CPU/memory spikes correlated with unusually large or high-cardinality baggage headers in access/APM logs; monitor for sudden latency degradation on services with tracing enabled.

What systems are affected by CVE-2026-50272?

This vulnerability affects the following AI/ML architecture patterns: model serving, agent frameworks, rag pipelines.

What is the CVSS score for CVE-2026-50272?

CVE-2026-50272 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.79%.

What is the AI security impact?

Affected AI Architectures

model servingagent frameworksrag pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.4

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0.

Exploitation Scenario

An unauthenticated attacker identifies a public-facing service instrumented with a vulnerable dd-trace version (observable via response headers, timing, or simply by testing) and sends an HTTP request containing a baggage header packed with thousands of comma-separated key-value pairs, or a single multi-megabyte value. The server's baggage parser processes the entire header without any item-count or byte-size cap, consuming excessive CPU and memory per request. Repeating this with a small number of concurrent requests is enough to exhaust server resources and deny service. If the target is an AI inference API or agent orchestration endpoint sitting behind this tracing middleware, the practical effect is an outage of the AI service itself, even though the AI model or agent logic was never touched.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.