Datadog dd-trace-py: IAST instrumentation can lead to application DOS
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.15.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Datadog's dd-trace-py, the Python APM client library used for application performance monitoring, is affected when its IAST (Interactive Application Security Testing) feature is enabled. An attacker who can supply input that the application formats with old-style % string formatting can cause the Python process to crash, denying service to the application's work.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- DataDog dd-trace-py
From 3.13.0 · fixed in 4.15.5
- ddtracePyPI
From 3.13.0 · fixed in 4.15.5