CVE-2026-116589
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Datadog dd-trace-py, the Datadog Python APM client, from 3.13.0 until 4.15.5 does not properly handle certain internal errors in IAST string-processing instrumentation when old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling.
Risk Assessment
An attacker can crash the application process, causing denial of service. Exploitation requires IAST to be enabled (not the default) and application code to apply the affected formatting operation to attacker-controlled input.
Recommendation
Upgrade dd-trace-py to version 4.15.5 or later. If IAST is not needed, keep it disabled.
Other vulnerabilities in dd-trace-py
See all- CVE-2026-116588High
Datadog dd-trace-py, the Datadog Python APM client, from 1.5.0 until 3.19.9 and 4.15.6 has a default query-string obfuscation regular expression that can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability.
- CVE-2026-50271High
The dd-trace-py (Python) library for Datadog does not enforce limits on the number or size of items in W3C baggage headers during extraction. A remote, unauthenticated attacker can send a request with an arbitrarily large number of key-value pairs or a single very large value, causing unbounded CPU and memory consumption.
Original NVD description (English source)
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS