PT-2026-125469
CVE-2026-116589
·
Published
2026-10-26
·
Updated
2026-10-27
Description by
CVSS 4.0
8.2
HighMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
dd-trace-py versions 3.13.0 through 4.15.4
Description
The IAST string-processing instrumentation fails to properly handle internal errors during old-style % string formatting when processing attacker-controlled input. This can lead to an unhandled error that terminates the Python process and interrupts active tasks. Exploitation requires IAST (Interactive Application Security Testing) to be enabled and the application code to perform the affected formatting operation on input controlled by an attacker.
Recommendations
Update to version 4.15.5.
Disable IAST instrumentation as a temporary mitigation measure.
Found an issue in the description? Have something to add? Feel free to write us 👾