Skip to content
OpenAdvisories

Package · Maven

com.datadoghq:dd-java-agent

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-50270

    dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

    dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage inject…

    Datadog com.datadoghq dd-trace-java dd-java-agent Maven
  • Critical 9.3
    CVE-2026-33728

    dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution

    dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and ear…

    Datadog dd-trace-java com.datadoghq:dd-java-agent Maven