Vendor
Datadog
29 known vulnerabilities.
Datadog at a glance
- Last 12 months
- 24
- Critical · all time
- 1
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 3 | 0 |
| Sep 2026 | 4 | 0 |
| Aug 2026 | 7 | 0 |
| Jul 2026 | 4 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 2 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 1 | 1 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 2 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 1 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
29 results · Feed
-
High 8.7
dd-trace: ReDOS in URL query string obfuscation
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously whil…
-
High 8.2
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled e…
-
High 8.7
Datadog dd-trace-py: ReDOS in URL query string obfuscation
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP …
-
High 7.5
dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS
dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are e…
-
High 7.5
Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_M…
-
High 7.5
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage inje…
-
High 7.5
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage inject…
-
High 7.5
dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog d…
-
Medium 6.5
In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported wit…
-
Medium 5.5
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWi…
-
Medium 6.5
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datad…
-
Medium 6.3
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts …
-
Medium 4.6
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive co…
-
Medium 6.4
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission g…
-
High 7.5
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the…
-
High 7.5
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforci…
-
High 7.5
dd-trace: Improper parsing of W3C baggage headers may lead to DoS
dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE…
-
High 7.5
Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS
Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGA…
-
High 8.2
GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with th…
-
Medium 5.0
GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A …
-
Critical 9.3
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and ear…
-
High 8.7
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction direc…
-
High 7.1
GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bom…
-
High 7.0
Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions
The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-scripts/__…
-
High 7.5
dd-trace-cpp malformed unicode header values may cause crash
dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the `nlohmann` JSON library. However, due to the way the JSON library…
-
High 8.1
import-in-the-middle allows unsanitized user controlled input in module generation
import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. P…
-
Medium 5.8
Arbitrary file write when scanning a specially-crafted local PyPI package
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to w…
-
Medium 5.8
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarb…
-
Low 3.0
DataDog API Client contains a Local Information Disclosure Vulnerability
The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to …