CVE-2026-116589

— UNSCOREDpublic exploit available

Published 2026-10-26 · Updated 2026-10-26

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.

Weaknesses

CWE-248

Public exploit & PoC references

https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7
https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69
https://github.com/DataDog/dd-trace-py/pull/20786
https://github.com/DataDog/dd-trace-py/pull/20823
https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5
https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6

All references

https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7
https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69
https://github.com/DataDog/dd-trace-py/pull/20786
https://github.com/DataDog/dd-trace-py/pull/20823
https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5
https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100347PoC
MEDIUMCVE-2026-100675PoC
MEDIUMCVE-2026-100722PoC
MEDIUMCVE-2026-101035PoC
MEDIUMCVE-2026-101101PoC
MEDIUMCVE-2026-101918PoC
HIGHCVE-2026-102281PoC
MEDIUMCVE-2026-102413

Related by shared AI tags and CWE weakness class. Browse the full archive.