CVE-2026-116589High· 8.2▾ TwilightDatadog dd-trace-py: IAST instrumentation can lead to application DOS
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default.
The affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input.
If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application.
Detailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior.
Denial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling.
ddtrace >= 3.13.0, < 4.15.5Upgrade to a patched release:
ddtrace 4.15.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116588High· 8.7Datadog dd-trace-py: ReDoS in URL query string obfuscation
CVE-2026-50271High· 7.5dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-105922Medium· 4.3A security flaw has been discovered in vllm-project vLLM up to 0.31.0
CVE-2026-105757Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-105756Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-102274Medium· 5.9PyJWT is a Python implementation of JSON Web Token standards