GHSA-p3m5-h5v9-vqj6

Suggest an improvement
Source
https://github.com/advisories/GHSA-p3m5-h5v9-vqj6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p3m5-h5v9-vqj6/GHSA-p3m5-h5v9-vqj6.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-p3m5-h5v9-vqj6
Aliases
Published
2026-10-27T15:37:24Z
Modified
2026-10-27T15:47:24Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
Details

Summary

A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default.

Details

The affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input.

If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application.

Proof of concept

Detailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior.

Impact

Denial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling.

Database specific 
{
    "cwe_ids":  [
        "CWE-248"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-27T15:37:24Z",
    "nvd_published_at":  "2026-10-26T22:16:55Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / ddtrace

Package

Name
ddtrace
View open source insights on deps.dev
Purl
pkg:pypi/ddtrace

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.13.0
Fixed
4.15.5

Affected versions

3.*
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0rc1
3.14.0rc2
3.14.0
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0rc1
3.15.0
3.15.1
3.16.0rc1
3.16.0rc2
3.16.0
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0rc1
3.17.0
3.17.1
3.17.2
3.17.3
3.18.0rc1
3.18.0rc2
3.18.0
3.18.1
3.19.0rc1
3.19.0
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.*
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0rc2
4.1.0rc3
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.0
4.2.1
4.2.2
4.2.3
4.3.0rc1
4.3.0
4.3.1
4.3.2
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.4.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.5.10
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.0
4.7.1
4.7.2
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.8.10
4.8.11
4.8.12
4.8.13
4.9.0rc1
4.9.0rc2
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.10.0rc1
4.10.0
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.10.10
4.10.11
4.10.12
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.0
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0rc1
4.12.0rc2
4.12.0
4.12.1
4.12.2
4.12.3
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.0
4.13.1
4.13.2
4.13.3
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.0
4.14.1
4.14.2
4.15.0rc1
4.15.0rc2
4.15.0
4.15.1
4.15.2
4.15.3
4.15.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p3m5-h5v9-vqj6/GHSA-p3m5-h5v9-vqj6.json"