Datadog dd-trace-py: Denial of service via IAST string formatting
Summary
The IAST string-processing instrumentation in the Datadog Python APM client dd-trace-py does not properly handle certain internal errors when old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it handles. Exploitation requires IAST to be enabled, which is not the default, and application code that applies the affected formatting operation to attacker-controlled input.
Affected
- Datadog dd-trace-py from 3.13.0 before 4.15.5
- Only applications with IAST enabled are affected
Fixed in
- Upgrade to dd-trace-py 4.15.5 or later (4.15.6 also fixes CVE-2026-116588)
Workaround
- Disable IAST by setting DD_IAST_ENABLED=false
- Replace % string interpolation of user input with str.format or f-strings
Exploitation
- No known exploitation in the wild
- No public proof-of-concept found
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- EPSS score is low (0.00328)
Our recommendation
- Check whether dd-trace-py is installed (pip show ddtrace, lockfiles) and whether DD_IAST_ENABLED is set
- If IAST is off, upgrade to 4.15.6 or later in the normal release cycle
- If IAST is on, upgrade or disable it and review % formatting of user input
- Check internet-facing Python services that pass user input into % formatting
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-p3m5-h5v9-vqj6 github.com
- Release v4.15.5 github.com
- Fix commit 69dc198 github.com
- Fix commit ace9724 github.com
- OSV GHSA-p3m5-h5v9-vqj6 osv.dev
- Tenable CVE-2026-116589 www.tenable.com
- GitLab advisory CVE-2026-116589 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:52.
Original description (NVD)
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.
NVD references (6)
- https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7
- https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69
- https://github.com/DataDog/dd-trace-py/pull/20786
- https://github.com/DataDog/dd-trace-py/pull/20823
- https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5
- https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.