Improper Error Handling in Datadog Python APM Client
CVE-2026-116589

8.2HIGH

Key Information:

Vendor

Datadog

Status
Dd-trace-py
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116589?

The Datadog dd-trace-py client has a vulnerability where improper handling of internal errors during string formatting can lead to application crashes. Affected versions from 3.13.0 to 4.15.5 allow exploitation if the IAST feature is enabled and attacker-controlled input is processed. Users are encouraged to upgrade to version 4.15.5 where this issue has been addressed, improving the overall stability and security of the application.

Affected Version(s)

dd-trace-py >= 3.13.0, < 4.15.5

References

https://github.com/DataDog/dd-trace-py/security/advisorie...
x_refsource_CONFIRM
https://github.com/DataDog/dd-trace-py/pull/20786
x_refsource_MISC
https://github.com/DataDog/dd-trace-py/pull/20823
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.