ddtrace
PyPI3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting ddtracepage 1 of 1
- CVE-2026-116588HIGHCVSS 8.7EG 8.7fixed in 3.19.9 or 4.15.6, by version range2026-10-26
vulnerable: 1.10.0 ... 3.9.4 (464 versions)
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL que…
- CVE-2026-116589HIGHCVSS 8.2EG 8.2fixed in 4.15.52026-10-26
vulnerable: 3.13.0 ... 4.9.7 (193 versions)
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled i…
- CVE-2026-50271HIGHCVSS 7.5EG 7.5fixed in 4.8.22026-07-15
vulnerable: 0.10.0 ... 4.8.1 (774 versions)
Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX…
Check whether ddtrace is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for ddtrace CVEs against the assets you own.
Book a Demo →