dd-trace-rb Gem Vulnerability: Improper W3C Baggage Header Parsing
An early warning has been issued regarding the dd-trace-rb gem, which reportedly improperly parses W3C baggage headers, potentially allowing a remote attacker to cause a Denial of Service. Users of dd-trace-rb versions prior to 2.32.0 are advised to upgrade or implement mitigations.
What happened
The dd-trace-rb gem, used for distributed tracing in Ruby applications, is under investigation for a vulnerability tracked as GHSA-P5F6-RCCC-JV98. This issue involves the improper parsing of W3C baggage headers, which appears to allow a remote attacker to trigger a Denial of Service by sending a request with an arbitrarily large number of key-value pairs in the baggage header.
To assess your exposure, check if your application uses the dd-trace-rb gem and whether the version is below 2.32.0. If so, it is recommended to upgrade to version 2.32.0 or later as a precaution. Alternatively, you can disable baggage extraction and set appropriate HTTP header size limits at the proxy or web server level to mitigate the risk.
For more detailed information, consult the primary source at https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98. The severity of this issue is currently classified as HIGH, and further details are expected as the investigation progresses.
How 0Day mitigates this
dd-trace-rb is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.