CVE-2026-50276 dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...

EUVD-2026-77671

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...

CVE-2026-50276

dd-trace-rb (Datadog's Ruby tracing library) is affected by a remote Denial of Service vulnerability (CVSS 7.5, HIGH) in its W3C baggage header extraction path. Prior to version 2.32.0 , the limits DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) were enforced...

CVE-2026-50276 dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...

EUVD-2026-77670

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50270

dd-trace-java (Datadog APM client for Java) versions prior to 1.62.0 are vulnerable to a remote Denial of Service due to improper parsing of W3C baggage headers. The extraction path in BaggagePropagator.java allocates a hash-map entry for each comma-separated key-value pair without enforcing DD_T...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Limit access to parser-buffer when tracegetuser fails. When the length of the string written to setftracefilter exceeds FTRACEBUFFMAX, the following KASAN alarm will be triggered: BUG: KASAN: Slab-out-of-bounds in...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fixed the calltrace warning in psphwfini. The call trace occurs when the amdgpu is removed after a mode1 reset. During a mode1 reset, from suspend to resume, there is no need to reinitialize the ta firmware buffer,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Whitelist slab/slub objects for copying to userspace Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu- results in a bug when the CONFIGHARDENEDUSERCOPY configuration is enabled, as shown belo...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fixed a null pointer dereference in the trace function. ucsiregisteraltmode checks if ISERR is true for the alt pointer and treats NULL as valid. When CONFIGTYPECDPALTMODE is not enabled, ucsiregisterdisplayport...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ftrace: A regression was fixed related to the module command in stacktracefilter. When executing the following command: echo "write:mod:ext3" /sys/kernel/tracing/stacktracefilter The current mod command causes a null pointer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Tracing: Fixed a use-after-free in printgraphfunctionflags during tracer switching. Kairui reported a Use-After-Free issue in printgraphfunctionflags during ftrace stress testing 1. This issue can be reproduced by putting a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Tracing: Verify event formats that use "%p.." syntax. The trace event verifier checks the formats of trace events to ensure that they do not reference memory that is not part of the event itself, or data that will never be freed...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Tracing: A silence warning is issued when chunk allocation fails in tracepidwrite. Syzkaller triggers a fault injection warning: WARNING: CPU: 1 PID: 12326 at tracepointaddfunc+0xbfc/0xeb0 Modules linked in: CPU: 1 UID: 0 PID:...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “perf trace: Really free the evsel-priv area” In 3cb4d5e00e037c70 “perf trace: Free syscall tp fields in evsel-priv”, it only freed the area if strcmpevsel-tpformat-system, “syscalls” returned zero. However, the initialization of...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: tracing/hist: Fix out-of-bound write on ‘actiondata.varrefidx’ When generating a synthetic event with many parameters and then creating a trace action for it 1, a kernel panic occurred 2. This issue arises because in...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Ring-Buffer: Fixed a deadloop issue when reading tracepipe. A soft lockup occurs when reading the file ‘tracepipe’: - Watchdog: BUG: Soft lockup – CPU6 stuck for 22 seconds! cat:4488 - ... - RIP: 0010:...