Dd Trace Py
Monthly
Denial of service in the Datadog dd-trace-py Python APM client, versions 3.13.0 through 4.15.4, where the IAST instrumentation for old-style % string formatting fails to contain an internal error and can terminate the entire Python process, interrupting whatever work it was handling. Three conditions must all hold for exploitation: IAST must be explicitly enabled (DD_IAST_ENABLED=true, which is not the default), the monitored application must apply a %-formatting operation to attacker-controlled input, and that input must contain a value the taint-tracking modulo aspect cannot process - the vendor release note specifically identifies a lone UTF-16 surrogate character that fails native UTF-8 conversion. This is a pure availability issue with no confidentiality or integrity impact; the advisory withholds reproduction steps, and no public exploit or active exploitation has been identified at time of analysis (EPSS 0.33%, not in CISA KEV).
Regular expression denial of service in the Datadog dd-trace-py Python APM client allows unauthenticated remote attackers to exhaust CPU and stall request handling by sending crafted URL query strings. The flaw affects versions 1.5.0 through 3.19.9 and 4.0.0 through 4.15.6, and the vulnerable obfuscation processing is enabled by default for HTTP tracing integrations that record query strings in URL span tags, so no special configuration is required to be at risk. Assessment is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:H, vendor CVSS 4.0 score 8.7); there is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS sits at 0.47% (40th percentile).
Denial of service in the Datadog dd-trace-py Python APM client, versions 3.13.0 through 4.15.4, where the IAST instrumentation for old-style % string formatting fails to contain an internal error and can terminate the entire Python process, interrupting whatever work it was handling. Three conditions must all hold for exploitation: IAST must be explicitly enabled (DD_IAST_ENABLED=true, which is not the default), the monitored application must apply a %-formatting operation to attacker-controlled input, and that input must contain a value the taint-tracking modulo aspect cannot process - the vendor release note specifically identifies a lone UTF-16 surrogate character that fails native UTF-8 conversion. This is a pure availability issue with no confidentiality or integrity impact; the advisory withholds reproduction steps, and no public exploit or active exploitation has been identified at time of analysis (EPSS 0.33%, not in CISA KEV).
Regular expression denial of service in the Datadog dd-trace-py Python APM client allows unauthenticated remote attackers to exhaust CPU and stall request handling by sending crafted URL query strings. The flaw affects versions 1.5.0 through 3.19.9 and 4.0.0 through 4.15.6, and the vulnerable obfuscation processing is enabled by default for HTTP tracing integrations that record query strings in URL span tags, so no special configuration is required to be at risk. Assessment is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:H, vendor CVSS 4.0 score 8.7); there is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS sits at 0.47% (40th percentile).