The dd-trace-rb library used for Datadog tracing implements W3C baggage propagation but fails to enforce limits on the number of items or total byte size when extracting baggage headers from incoming HTTP requests. While limits exist for baggage injection, extraction lacks these controls, allowing attackers to craft requests with arbitrarily large or numerous baggage entries. Each key-value pair causes the tracer to allocate a hash-map entry, leading to unbounded CPU and memory usage. This vulnerability enables remote, unauthenticated denial of service attacks on services using affected versions with baggage propagation enabled by default. The issue is fixed in dd-trace-rb version 2.32.0 and later.

A remote unauthenticated attacker can cause a denial of service by sending HTTP requests with excessively large or numerous W3C baggage header entries. This triggers unbounded CPU and memory consumption in the tracer, potentially disrupting service availability. There is no impact on confidentiality or integrity reported.

Upgrade to dd-trace-rb version 2.32.0 or later to apply the official fix. If immediate upgrade is not possible, mitigate by disabling baggage extraction via configuration (removing 'baggage' from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT). Additionally, limit the maximum HTTP request header size at upstream proxies or web servers (e.g., Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb) to reduce risk.