{"id":"CVE-2026-116589","aliases":["EUVD-2026-110470","GHSA-p3m5-h5v9-vqj6","ROOT-APP-PYPI-CVE-2026-116589"],"status":"published","title":"Datadog dd-trace-py: IAST instrumentation can lead to application DOS","description":"Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00328,"percentile":0.26224,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2026-10-26T21:26:58Z","modified":"2026-11-01T07:03:37Z","fixes":[{"ecosystem":"PyPI","package":"ddtrace","fixed_in":["4.15.5"],"sources":["ghsa","osv"]},{"ecosystem":"Root:PyPI","package":"ddtrace","fixed_in":["4.13.2+aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"ddtrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.0"},{"fixed":"4.15.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ddtrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.0"},{"fixed":"4.15.5"}]}],"versions":["3.13.0","3.13.1","3.13.2","3.13.3","3.13.4","3.14.0","3.14.0rc1","3.14.0rc2","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0rc1","3.15.1","3.16.0","3.16.0rc1","3.16.0rc2","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0rc1","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0rc1","3.18.0rc2","3.18.1","3.19.0","3.19.0rc1","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5","3.19.6","3.19.7","3.19.8","3.19.9","4.0.0","4.0.0rc1","4.0.0rc2","4.0.0rc3","4.0.1","4.0.2","4.0.3","4.0.4","4.1.0","4.1.0rc2","4.1.0rc3","4.1.1","4.1.2","4.1.3","4.1.4","4.10.0","4.10.0rc1","4.10.1","4.10.10","4.10.11","4.10.12","4.10.2","4.10.3","4.10.4","4.10.5","4.10.6","4.10.7","4.10.8","4.10.9","4.11.0","4.11.0rc1","4.11.0rc2","4.11.0rc3","4.11.0rc4","4.11.0rc5","4.11.0rc6","4.11.0rc7","4.11.1","4.11.2","4.11.3","4.11.4","4.11.5","4.11.6","4.11.7","4.11.8","4.12.0","4.12.0rc1","4.12.0rc2","4.12.1","4.12.2","4.12.3","4.13.0","4.13.0rc1","4.13.0rc2","4.13.0rc3","4.13.1","4.13.2","4.13.3","4.14.0","4.14.0rc1","4.14.0rc2","4.14.0rc3","4.14.0rc4","4.14.1","4.14.2","4.15.0","4.15.0rc1","4.15.0rc2","4.15.1","4.15.2","4.15.3","4.15.4","4.2.0","4.2.0rc1","4.2.0rc2","4.2.0rc3","4.2.1","4.2.2","4.2.3","4.3.0","4.3.0rc1","4.3.1","4.3.2","4.4.0","4.4.0rc1","4.4.0rc2","4.4.0rc3","4.5.0","4.5.0rc1","4.5.0rc2","4.5.0rc3","4.5.0rc4","4.5.1","4.5.10","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.5.8","4.5.9","4.6.0","4.6.0rc1","4.6.0rc2","4.6.0rc3","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.6.6","4.6.7","4.6.8","4.7.0","4.7.0rc1","4.7.0rc2","4.7.0rc3","4.7.0rc4","4.7.0rc5","4.7.1","4.7.2","4.8.0","4.8.0rc1","4.8.0rc2","4.8.0rc3","4.8.0rc4","4.8.0rc5","4.8.1","4.8.10","4.8.11","4.8.12","4.8.13","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.8.7","4.8.8","4.8.9","4.9.0","4.9.0rc1","4.9.0rc2","4.9.1","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7"]},{"source":"osv","ecosystem":"Root:PyPI","package":"ddtrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.2+aikido.1"}]}]}],"products":[{"vendor":"datadog","product":"dd-trace-py"}],"references":[{"url":"https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/DataDog/dd-trace-py/pull/20786","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/DataDog/dd-trace-py/pull/20823","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116589","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p3m5-h5v9-vqj6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116589.json","tags":["advisory"]},{"url":"https://github.com/DataDog/dd-trace-py","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-116589","title":"Datadog dd-trace-py: IAST instrumentation can lead to application DOS","description":"Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.","status":"published","published":"2026-10-26T21:26:58.832Z","modified":"2026-10-31T01:53:57.07Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:20:03.827373Z"}],"euvd":[{"id":"EUVD-2026-110470","description":"Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.","status":"published","published":"2026-10-26T21:26:58Z","modified":"2026-10-31T01:53:57Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:01.198534Z"}],"ghsa":[{"id":"GHSA-p3m5-h5v9-vqj6","title":"Datadog dd-trace-py: IAST instrumentation can lead to application DOS","description":"### Summary\n\nA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default.\n\n### Details\n\nThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input.\n\nIf you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application.\n\n### Proof of concept\n\nDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior.\n\n### Impact\n\nDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling.","status":"published","published":"2026-10-27T15:37:24Z","modified":"2026-10-27T15:37:26Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:41:37.912288Z"}],"nvd":[{"id":"CVE-2026-116589","description":"Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.","status":"published","published":"2026-10-26T22:16:55.49Z","modified":"2026-10-31T02:17:33.27Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:13:03.746397Z"}],"osv":[{"id":"CVE-2026-116589","title":"Datadog dd-trace-py: IAST instrumentation can lead to application DOS","description":"Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.","status":"published","published":"2026-10-26T21:26:58.832Z","modified":"2026-11-01T07:03:37.103398281Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:44:56.675758Z"},{"id":"GHSA-p3m5-h5v9-vqj6","title":"Datadog dd-trace-py: IAST instrumentation can lead to application DOS","description":"### Summary\n\nA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default.\n\n### Details\n\nThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input.\n\nIf you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application.\n\n### Proof of concept\n\nDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior.\n\n### Impact\n\nDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling.","status":"published","published":"2026-10-27T15:37:24Z","modified":"2026-10-27T15:47:24.739372721Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"ROOT-APP-PYPI-CVE-2026-116589","title":"CVE-2026-116589 in ddtrace - Patched by Root","description":"Root has patched CVE-2026-116589 in the ddtrace package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-30T14:46:12Z","modified":"2026-10-30T15:15:02.61722754Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}