Datadog vulnerabilities
29 CVEs and advisories name Datadog as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-116693dd-trace: ReDOS in URL query string obfuscation
- CVE-2026-116589Datadog dd-trace-py: IAST instrumentation can lead to application DOS
- CVE-2026-116588Datadog dd-trace-py: ReDOS in URL query string obfuscation
- CVE-2026-50277dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50275Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50276dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50270dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-54788dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
- CVE-2026-44965In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, Monitor
- CVE-2026-44964In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard
- CVE-2026-47364In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user
- CVE-2026-47363In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied
- CVE-2026-47361In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SE
- CVE-2026-47362In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: L
- CVE-2026-50271dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50274dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50272dd-trace: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-50273Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
- CVE-2026-44971GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
- CVE-2026-44972GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
- CVE-2026-33728dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
- CVE-2026-22871GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
- CVE-2026-22870GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
- CVE-2025-61667Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions
- CVE-2024-38525dd-trace-cpp malformed unicode header values may cause crash
- CVE-2023-38704import-in-the-middle allows unsanitized user controlled input in module generation
- CVE-2022-23531Arbitrary file write when scanning a specially-crafted local PyPI package
- CVE-2022-23530GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
- CVE-2021-21331DataDog API Client contains a Local Information Disclosure Vulnerability