---
id: "CVE-2026-116589"
kind: "vulnerability"
aliases: ["CVE-2026-116589"]
title: "dd-trace-py: IAST formatting bug can crash Python processes handling input"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apm", "datadog", "package", "python"]
not_affected_if: ["default-config", "iast-disabled"]
published_at: "2026-10-26T22:16:55+00:00"
first_seen_at: "2026-10-26T22:25:33+00:00"
updated_at: "2026-10-26T22:27:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116589", "first_seen_at": "2026-10-26T22:25:33+00:00"}]
---

# dd-trace-py: IAST formatting bug can crash Python processes handling input

The Datadog Python APM client (dd-trace-py) versions 3.13.0 through 4.15.4 mishandle internal errors in its IAST string-formatting instrumentation. Attacker-controlled input passed through old-style % formatting can terminate the Python process and interrupt its work.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pip show ddtrace` and check whether the version is between `3.13.0` and `4.15.4`.
- Check whether IAST is enabled, for example via the `DD_IAST_ENABLED` environment variable set to `true`.

## Fix

- Upgrade `ddtrace` to `4.15.5` or later.

## Timeline

- 2026-10-26T22:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116589

## From the sources

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_