Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| datadog | rubygems | < 2.32.0 | 2.32.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the improper parsing of W3C baggage headers, leading to a potential Denial of Service. The advisory states that item-count and byte-size limits were not enforced during the extraction of baggage from incoming HTTP headers. The patched version is 2.32.0. By comparing the git tags for v2.31.0 and v2.32.0, I identified a set of commits. Among them, commit 361947090214488778ac4f144e219426ffcf92e6 with the message "Limit processing of large Baggage data" directly addresses the issue. The changes are in lib/datadog/tracing/distributed/baggage.rb, specifically within the parse_baggage_header function. Before the patch, this function would split the baggage header string without any limits. The patch introduces checks for DD_TRACE_BAGGAGE_MAX_BYTES and DD_TRACE_BAGGAGE_MAX_ITEMS, preventing the uncontrolled resource consumption. Therefore, Datadog::Tracing::Distributed::Baggage.parse_baggage_header is the vulnerable function.
Datadog::Tracing::Distributed::Baggage.parse_baggage_headerlib/datadog/tracing/distributed/baggage.rb