Cloudanix VulnDB

CVE-2026-116589

None

CVSS

—

EPSS

0.3%

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a monitoring tool can make some Python applications crash when they handle certain user data, but only if a special diagnostic feature is turned on.

Exploitation
Other
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unhandled internal error during IAST string-processing instrumentation for old-style Python % formatting of attacker-controlled input causes the Python interpreter process to terminate.

Why it matters to the business

Applications using the vulnerable library with IAST enabled can be forced offline, resulting in service interruption and operational downtime; the low prevalence of IAST usage and stable low exploit probability limit widespread impact.

How an attack unfolds

An attacker supplies specially crafted input that triggers an unhandled exception inside the IAST instrumentation when the application performs % string formatting; because the error is not caught, the Python process exits, interrupting the request or worker handling the input. Exploitation requires IAST to be explicitly enabled.

How to fix it

Upgrade dd-trace-py to version 4.15.5 or later. If immediate upgrade is not possible, disable IAST instrumentation until the patch can be applied.

How to confirm the fix worked

Confirm the installed dd-trace-py version is 4.15.5 or newer; with IAST enabled, exercise application code paths that perform % formatting on untrusted input and verify the process does not terminate.

Typical attack path

  1. Identify an application endpoint that performs old-style % string formatting on user-supplied data while IAST is enabled.
  2. Craft and submit input designed to cause an internal error inside the IAST string-processing hook.
  3. Trigger the unhandled exception, causing the Python process to terminate and the current request or worker to fail.

How to detect it

Review application and Python interpreter logs for unexpected process exits or unhandled exceptions originating from ddtrace IAST modules during string formatting operations; correlate with request logs containing % formatting patterns on external input.

What your security team should do

  • Prioritize upgrade to dd-trace-py 4.15.5 within normal change windows given low EPSS and non-default IAST requirement.
  • Audit configurations to identify any environments where IAST is enabled and assess exposure of formatting operations on external input.
  • Add the library to standard dependency scanning and update automation to prevent future version drift.

The record

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities