Datadog dd-trace-py is the Datadog Python APM client.
CVE-2026-116589
Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DDIASTENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of concept Detailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. Impact Denial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful…
Assessment
- CVSS
- 8.2 (v4.0)
- Severity
- High
- EPSS
- 0.00328% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 31 October 2026
- Affected
- pip · ddtrace
- Weakness
- CWE-248
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
At the source
References
- https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7
- https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69
- https://github.com/DataDog/dd-trace-py/pull/20786
- https://github.com/DataDog/dd-trace-py/pull/20823
- https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5
- https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6
- https://nvd.nist.gov/vuln/detail/CVE-2026-116589
- https://github.com/advisories/GHSA-p3m5-h5v9-vqj6
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-116589