Datadog dd-trace-py CVE-2026-116589

Three concrete conditions must all hold: (1) IAST must be explicitly enabled via DD_IAST_ENABLED=true - it is OFF by default, which is the single biggest limiting factor; (2) the monitored application code must apply an old-style %-string-formatting operation (e.g. 'template %s' % value) to attacker-controlled input - f-strings and str.format are not affected; (3) the attacker-supplied input must contain a value that the taint-tracking modulo aspect cannot process, specifically a lone UTF-16 surrogate character (e.g. \ud800) that fails native UTF-8 conversion. Affected builds are dd-trace-py 3.13.0 through 4.15.4 on Python applications. The attack needs no authentication or user interaction at the dd-trace layer (PR:N/UI:N), but the combination of a non-default security feature plus a specific vulnerable code pattern substantially limits realistic exposure.

The headline CVSS 4.0 base score of 8.2 (High) is driven entirely by availability impact (VA:H), with no confidentiality or integrity impact (VC:N/VI:N) - this is a pure denial-of-service, consistent with CWE-248 (uncaught exception). The vector shows AV:N/PR:N/UI:N (network-reachable, no authentication or user interaction at the dd-trace layer), which inflates the score, but AT:P signals a present attack requirement and the real-world exposure is heavily gated by two preconditions stated in the vendor advisory: IAST must be explicitly enabled (DD_IAST_ENABLED=true, which is NOT the default) and the monitored application must pass attacker-controlled input through an old-style %-formatting operation. The supporting signals point to modest real-world risk: EPSS is 0.33% (26th percentile), there is no CISA KEV listing, and the vuln.today Decision label is 'this_week' rather than act_now/emergency. This is therefore a genuine but non-emergency priority - a high-CVSS DoS whose practical reach is narrowed by a non-default configuration and a specific code pattern. The EPSS/KEV signals (low probability, no confirmed active exploitation) are consistent with each other and with the gated exploitation conditions; nothing here indicates widespread opportunistic exploitation. Note the input CVSS is 4.0 only - no CVSS 3.1 vector was supplied - and the 'Information Disclosure' tag contradicts the availability-only impact (see data_quality_flags).

An attacker sends input containing a lone UTF-16 surrogate character (e.g. \ud800) to an application running a vulnerable dd-trace-py (3.13.0-4.15.4) with IAST enabled, where that input is rendered through an old-style '... %s' % value formatting operation. The IAST modulo taint-tracking aspect cannot UTF-8-encode the lone surrogate, raises an unhandled native error, and aborts the Python process, dropping in-flight work. No weaponized public exploit is published; the fix PR (#20786) includes a regression test that demonstrates the exact triggering input, but the advisory deliberately omits detailed reproduction steps.