Uncaught Exception Affecting datadog-agent-7.79 package, versions <7.79.2-r21


Severity

Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.29% (20th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-DATADOGAGENT779-20414068
  • published3 Oct 2026
  • disclosed28 Sept 2026

Introduced: 28 Sep 2026

NewCVE-2026-101918  (opens in a new tab)
CWE-248  (opens in a new tab)

How to fix?

Upgrade Chainguard datadog-agent-7.79 to version 7.79.2-r21 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream datadog-agent-7.79 package and not the datadog-agent-7.79 package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.

CVSS Base Scores

version 3.1