dd-trace-py vulnerabilities

Datadog dd-trace-py, the Datadog Python APM client, from 3.13.0 until 4.15.5 does not properly handle certain internal errors in IAST string-processing instrumentation when old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling.

Datadog dd-trace-py, the Datadog Python APM client, from 1.5.0 until 3.19.9 and 4.15.6 has a default query-string obfuscation regular expression that can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability.

The dd-trace-py (Python) library for Datadog does not enforce limits on the number or size of items in W3C baggage headers during extraction. A remote, unauthenticated attacker can send a request with an arbitrarily large number of key-value pairs or a single very large value, causing unbounded CPU and memory consumption.