Zero Radar
← feed
HighVulnerabilityCVE-2026-116589updated 27 Oct 2026, 15:37 UTC

Datadog Python tracer can crash apps when IAST processes certain input

A monitoring library for Python apps can cause the app process to stop when it handles specially crafted input. Only apps that turn on a specific security scanning feature are affected.

Fixed in ddtrace 4.15.5Official, 2 sources
SeverityHighCVSS 8.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesddtrace 4.15.5 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends inputCrafted input reaches the app
  2. 2App formats stringOld-style % formatting on that input
  3. 3IAST instrumentation failsUnhandled internal error occurs
  4. 4Process terminatesPython process crashes, work is interrupted
  5. ResultApplication process crashes (denial of service)

What happened

dd-trace-py (Datadog APM client) versions 3.13.0 up to 4.15.5 have an unhandled error in IAST string-processing instrumentation that triggers when old-style % string formatting handles attacker-controlled input, terminating the Python process.

Why it is dangerous: An attacker who can send crafted input can crash the affected process, causing denial of service and interrupting in-progress work. Applications with IAST enabled and exposing this formatting to user input are at risk.

Are you affected?

You are affected if you run dd-trace-py 3.13.0 up to (not including) 4.15.5 with IAST enabled (DD_IAST_ENABLED=true, not the default) and your code applies % string formatting to attacker-controlled input.

Package / productAffected versionsFixed in
ddtrace · pip>= 3.13.0, < 4.15.54.15.5

What to do

  1. Update ddtrace to 4.15.5 or later
  2. If you cannot upgrade yet, set DD_IAST_ENABLED=false
  3. Alternatively, replace % string formatting on user input with str.format or f-strings

Timeline

  1. 26 Oct 2026, 22:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 22:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 22:19 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 15:37 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 15:37 UTC
    Fixed version published: ddtrace 4.15.5 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116589 · GHSA-p3m5-h5v9-vqj6
CVSS
8.2 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 22:16 UTC
On Zero Radar
26 Oct 2026, 22:19 UTC (3 min after disclosure)
Last change
27 Oct 2026, 15:37 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Datadog Python tracer can crash apps when IAST processes certain input · Zero Radar