CVE-2026-116589

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116589", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-26T15:03:39.036Z", "datePublished": "2026-10-26T21:26:58.832Z", "dateUpdated": "2026-10-31T01:53:57.070Z"}, "containers": {"cna": {"title": "Datadog dd-trace-py: IAST instrumentation can lead to application DOS", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6"}, {"name": "https://github.com/DataDog/dd-trace-py/pull/20786", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/pull/20786"}, {"name": "https://github.com/DataDog/dd-trace-py/pull/20823", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/pull/20823"}, {"name": "https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7"}, {"name": "https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69"}, {"name": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5"}], "affected": [{"vendor": "DataDog", "product": "dd-trace-py", "versions": [{"version": ">= 3.13.0, < 4.15.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-26T21:26:58.832Z"}, "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5."}], "source": {"advisory": "GHSA-p3m5-h5v9-vqj6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-31T01:53:46.341722Z", "id": "CVE-2026-116589", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-31T01:53:57.070Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116589", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-26T15:03:39.036Z", "datePublished": "2026-10-26T21:26:58.832Z", "dateUpdated": "2026-10-31T01:53:57.070Z"}, "containers": {"cna": {"title": "Datadog dd-trace-py: IAST instrumentation can lead to application DOS", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6"}, {"name": "https://github.com/DataDog/dd-trace-py/pull/20786", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/pull/20786"}, {"name": "https://github.com/DataDog/dd-trace-py/pull/20823", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/pull/20823"}, {"name": "https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7"}, {"name": "https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69"}, {"name": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5"}], "affected": [{"vendor": "DataDog", "product": "dd-trace-py", "versions": [{"version": ">= 3.13.0, < 4.15.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-26T21:26:58.832Z"}, "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5."}], "source": {"advisory": "GHSA-p3m5-h5v9-vqj6", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116589", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-31T01:53:46.341722Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-31T01:53:52.730Z"}}]}}

{"affected": [{"affectedData": [{"product": "dd-trace-py", "vendor": "DataDog", "versions": [{"status": "affected", "version": ">= 3.13.0, < 4.15.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5."}], "id": "CVE-2026-116589", "lastModified": "2026-10-31T02:17:33.270", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116589", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-31T01:53:46.341722Z", "version": "2.0.3"}}]}, "published": "2026-10-26T22:16:55.490", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/pull/20786"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/pull/20823"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ddtrace: ddtrace: Denial of Service via unhandled error in IAST string formatting", "id": "2561459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561459"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-248", "details": ["Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.", "A flaw was found in ddtrace. This issue allows a remote attacker to cause a denial of service (DoS) when Interactive Application Security Testing (IAST) is enabled. Specifically, the string-processing instrumentation fails to handle internal errors during old-style string formatting operations. By submitting crafted input to an application performing these operations, an attacker can trigger an unhandled error that terminates the Python process."], "name": "CVE-2026-116589", "public_date": "2026-10-26T21:26:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116589\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116589\nhttps://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7\nhttps://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69\nhttps://github.com/DataDog/dd-trace-py/pull/20786\nhttps://github.com/DataDog/dd-trace-py/pull/20823\nhttps://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5\nhttps://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6"], "statement": "Red Hat has evaluated this vulnerability as having a Moderate impact because exploitation requires non-default configuration settings alongside specific application-level coding patterns to cause a denial of service. The underlying issue in ddtrace only manifests when Interactive Application Security Testing (IAST) is explicitly turned on, which is disabled in default environments. Furthermore, an attacker must supply crafted input that is subsequently processed by old-style string interpolation within the monitored application. Because the flaw only causes process termination without compromising data confidentiality or system integrity, the overall risk remains bounded.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.13.0,4.15.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "dd-trace-py", "source": "cna", "vendor": "DataDog"}, "product": "dd-trace-py", "vendor": "datadog"}], "created": "2026-10-27T05:30:14.936337+00:00", "updated": "2026-10-27T05:45:14.346253+00:00", "vendors": ["datadog", "datadog$PRODUCT$dd-trace-py"]}