{"id":"CVE-2026-116589","kind":"vulnerability","aliases":["CVE-2026-116589"],"related":[],"title":"dd-trace-py: IAST formatting bug can crash Python processes handling input","description":"Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.","summary":"The Datadog Python APM client (dd-trace-py) versions 3.13.0 through 4.15.4 mishandle internal errors in its IAST string-formatting instrumentation. Attacker-controlled input passed through old-style % formatting can terminate the Python process and interrupt its work.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apm","datadog","package","python"],"not_affected_if":["default-config","iast-disabled"],"how_to_check":"- Run `pip show ddtrace` and check whether the version is between `3.13.0` and `4.15.4`.\n- Check whether IAST is enabled, for example via the `DD_IAST_ENABLED` environment variable set to `true`.","fix":"- Upgrade `ddtrace` to `4.15.5` or later.","status":"open","published_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:27:39+00:00","updated_at":"2026-10-26T22:27:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `ddtrace` to `4.15.5` or later.","reach":"internet","title":"dd-trace-py: IAST formatting bug can crash Python processes handling input","impact":"low","summary":"The Datadog Python APM client (dd-trace-py) versions 3.13.0 through 4.15.4 mishandle internal errors in its IAST string-formatting instrumentation. Attacker-controlled input passed through old-style % formatting can terminate the Python process and interrupt its work.","category":"package","nicknames":[],"who_cares":["python","datadog","apm"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Python process crashes, interrupting in-flight request handling","analyst_note":"","how_to_check":"- Run `pip show ddtrace` and check whether the version is between `3.13.0` and `4.15.4`.\n- Check whether IAST is enabled, for example via the `DD_IAST_ENABLED` environment variable set to `true`.","needs_analyst":false,"not_affected_if":["iast-disabled","default-config"],"who_is_affected":"Only applications that run dd-trace-py in the affected range with IAST turned on, and whose code applies % string formatting to attacker-controlled input. IAST is not on by default, so deployments with it off are not exposed by this issue.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000584,"input_tokens":3373,"output_tokens":493,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116589':16A,19A '-2026':15A,18A '3.13.0':34B,78C '4.15.4':36B '4.15.5':80C,151C 'affect':137C 'apm':20B,27B,75C 'appli':135C 'applic':132C 'attack':48B,102C,142C 'attacker-control':47B,101C,141C 'bug':7A 'certain':91C 'client':28B,76C 'code':133C 'control':49B,103C,143C 'crash':9A 'cve':14A,17A 'datadog':21B,25B,66C,73C 'dd':2A,30B,68C 'dd-trace-pi':1A,29B,67C 'default':130C 'enabl':125C 'error':39B,93C,107C 'exploit':120C 'fix':148C 'format':6A,45B,56B,99C,138C 'handl':12A,90C,119C 'iast':5A,42B,82C,122C 'input':13A,50B,104C,144C 'instrument':46B,86C 'intern':38B,92C 'interrupt':63B,114C 'issu':146C 'mishandl':37B 'old':54B,96C 'old-styl':53B,95C 'oper':139C 'packag':22B 'pass':51B 'process':11A,61B,85C,100C,112C 'proper':89C 'py':4A,32B,70C 'python':10A,23B,26B,60B,74C,111C 'requir':121C 'string':44B,84C,98C 'string-format':43B 'string-process':83C 'style':55B,97C 'termin':58B,109C 'trace':3A,31B,69C 'unhandl':106C 'version':33B,150C 'work':65B,116C","nicknames":[],"mitigations":[],"who_affected":"Only applications that run dd-trace-py in the affected range with IAST turned on, and whose code applies % string formatting to attacker-controlled input. IAST is not on by default, so deployments with it off are not exposed by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116589","severity":null,"published_at":"2026-10-26T22:16:55+00:00","modified_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}