Datadog
Monthly
Denial of service in Datadog's dd-trace-cpp distributed tracing library prior to 2.1.0: the W3C baggage extraction path parses the attacker-controlled 'baggage' HTTP header without applying the DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits that are already enforced on the injection path. A remote, unauthenticated attacker can send a header containing a very large number of comma-separated key-value pairs, or a single oversized value, to force unbounded hash-map allocation and CPU/memory consumption per request on internet-facing services that use the C++ tracer with baggage extraction enabled (the default unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT). No public exploit identified at time of analysis; impact is availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Unbounded CPU and memory consumption in the Datadog PHP Tracer (dd-trace-php) before 1.19.2 allows remote, unauthenticated attackers to exhaust resources on any instrumented PHP worker that parses W3C baggage headers. The tracer's baggage deserializer fails to enforce DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES, so a request carrying an arbitrarily long list of comma-separated key-value pairs, or a single oversized value, forces unbounded hash-map allocation and parsing work on every request; because baggage extraction is enabled by default in most deployments, exposure is broad and pre-authentication, though the impact is limited to availability with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.19.2 (with 1.20.0 also containing the change).
Metric and tag injection in the Perl DataDog::DogStatsd client (versions through 0.07) allows attackers who control event tag content to inject arbitrary metrics, tags, and event data into the DogStatsd telemetry stream. The CVSS 9.8 score reflects an unauthenticated network-vector CWE-93 (CRLF/separator injection) flaw where the format_event method fails to sanitize commas, newlines, pipes, and colons - including an ineffective s/|//g regex that misinterprets the pipe as a regex metacharacter. No public exploit identified at time of analysis and EPSS sits at 0.03% (8th percentile), indicating low observed exploitation interest despite the high CVSS rating.
Metric injection in the Perl DataDog::DogStatsd client (versions through 0.07) allows remote attackers to forge or manipulate StatsD metrics by supplying unsanitised input containing newlines, pipes, or colons in stat names, values, or tags. With a CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) rating and CWE-93 (CRLF Injection) classification, attackers can corrupt monitoring data, change metric name prefixes, or inject arbitrary metrics - the SYNOPSIS example of passing a web form 'loginName' parameter as a tag is explicitly called out as unsafe. EPSS is very low (0.03%) and no public exploit identified at time of analysis, but the trivial network attack profile means risk depends entirely on whether untrusted input reaches the library.
A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Denial of service in Datadog's dd-trace-cpp distributed tracing library prior to 2.1.0: the W3C baggage extraction path parses the attacker-controlled 'baggage' HTTP header without applying the DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits that are already enforced on the injection path. A remote, unauthenticated attacker can send a header containing a very large number of comma-separated key-value pairs, or a single oversized value, to force unbounded hash-map allocation and CPU/memory consumption per request on internet-facing services that use the C++ tracer with baggage extraction enabled (the default unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT). No public exploit identified at time of analysis; impact is availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Unbounded CPU and memory consumption in the Datadog PHP Tracer (dd-trace-php) before 1.19.2 allows remote, unauthenticated attackers to exhaust resources on any instrumented PHP worker that parses W3C baggage headers. The tracer's baggage deserializer fails to enforce DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES, so a request carrying an arbitrarily long list of comma-separated key-value pairs, or a single oversized value, forces unbounded hash-map allocation and parsing work on every request; because baggage extraction is enabled by default in most deployments, exposure is broad and pre-authentication, though the impact is limited to availability with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.19.2 (with 1.20.0 also containing the change).
Metric and tag injection in the Perl DataDog::DogStatsd client (versions through 0.07) allows attackers who control event tag content to inject arbitrary metrics, tags, and event data into the DogStatsd telemetry stream. The CVSS 9.8 score reflects an unauthenticated network-vector CWE-93 (CRLF/separator injection) flaw where the format_event method fails to sanitize commas, newlines, pipes, and colons - including an ineffective s/|//g regex that misinterprets the pipe as a regex metacharacter. No public exploit identified at time of analysis and EPSS sits at 0.03% (8th percentile), indicating low observed exploitation interest despite the high CVSS rating.
Metric injection in the Perl DataDog::DogStatsd client (versions through 0.07) allows remote attackers to forge or manipulate StatsD metrics by supplying unsanitised input containing newlines, pipes, or colons in stat names, values, or tags. With a CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) rating and CWE-93 (CRLF Injection) classification, attackers can corrupt monitoring data, change metric name prefixes, or inject arbitrary metrics - the SYNOPSIS example of passing a web form 'loginName' parameter as a tag is explicitly called out as unsafe. EPSS is very low (0.03%) and no public exploit identified at time of analysis, but the trivial network attack profile means risk depends entirely on whether untrusted input reaches the library.
A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.