Vulnerability	Vulnerable Version
H Regular Expression Denial of Service (ReDoS) ddtrace is a Datadog APM client library Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `redact_query_string` function in `ddtrace/internal/utils/http.py`, which applies a query string obfuscation regex without guarding against quadratic (catastrophic) backtracking. An attacker who can cause an instrumented HTTP integration to process a URL containing a query string can trigger worst-case regex evaluation time, crashing or stalling the traced process and causing a denial of service. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `ddtrace` to version 3.19.9, 4.15.6 or higher.	[1.5.0,3.19.9)[4.0.0,4.15.6)
H Uncaught Exception ddtrace is a Datadog APM client library Affected versions of this package are vulnerable to Uncaught Exception via `modulo_aspect` in the IAST taint-tracking C++ extension, when a lone surrogate character is passed as a format argument to the `%` (modulo) string operator. The unhandled surrogate causes a process abort, crashing the entire Python process. Note: This is only exploitable if the IAST feature is explicitly enabled, as it is disabled by default. How to fix Uncaught Exception? Upgrade `ddtrace` to version 4.15.5 or higher.	[3.13.0,4.15.5)

Regular Expression Denial of Service (ReDoS)

ddtrace is a Datadog APM client library

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the redact_query_string function in ddtrace/internal/utils/http.py, which applies a query string obfuscation regex without guarding against quadratic (catastrophic) backtracking. An attacker who can cause an instrumented HTTP integration to process a URL containing a query string can trigger worst-case regex evaluation time, crashing or stalling the traced process and causing a denial of service.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade ddtrace to version 3.19.9, 4.15.6 or higher.

[1.5.0,3.19.9)[4.0.0,4.15.6)

Uncaught Exception

ddtrace is a Datadog APM client library

Affected versions of this package are vulnerable to Uncaught Exception via modulo_aspect in the IAST taint-tracking C++ extension, when a lone surrogate character is passed as a format argument to the % (modulo) string operator. The unhandled surrogate causes a process abort, crashing the entire Python process.

Note: This is only exploitable if the IAST feature is explicitly enabled, as it is disabled by default.

How to fix Uncaught Exception?

Upgrade ddtrace to version 4.15.5 or higher.

[3.13.0,4.15.5)

Go back to all versions of this package