AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Packages

Datadog security advisories

27 advisories · 22 critical or high in 12 months · latest Oct 8

27 advisories

High 8.7Oct 8ReDOS in URL query string obfuscationGHSA-9x8v-5f43-c55rfixed in 1.67.1 +1High 8.7Oct 8ReDOS in URL query string obfuscationGHSA-x94g-w73q-hpcwfixed in 5.131.1 +1High 8.8Oct 8Worker-writable shared-memory metadata allows local privilege escalation to rootGHSA-fmrj-jm6v-j549fixed in 1.26.0High 8.7Oct 8ReDOS in URL query string obfuscationGHSA-49fg-59cp-2hqjfixed in 1.26.0High 7.8Oct 8Unauthenticated crashtracker IPC allows arbitrary root file writeGHSA-j3g8-6962-2xqqfixed in 1.26.0High 8.7Oct 8ReDOS in URL query string obfuscationGHSA-3633-r77q-h3v3fixed in 3.19.9 +1High 8.2Oct 7IAST instrumentation can lead to application DOSGHSA-p3m5-h5v9-vqj6fixed in 4.15.5High 7.4Jul 7Datadog SSI Injector can be used to trigger a Local Privilege Escalation in certain conditionsCVE-2026-61581fixed in 0.66.0High 7.5Jun 22Unbounded W3C tracestate parsing may lead to DoSCVE-2026-54788fixed in 0.3.3High 7.5Jun 9Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50277fixed in 2.1.0High 7.5Jun 5Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50276fixed in 2.32.0High 7.5Jun 5Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50274fixed in 2.8.1 +1High 7.5Jun 5Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50272fixed in 5.100.0High 7.5Jun 5Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50273fixed in 3.43.0 +1High 7.5Jun 5Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50271fixed in 4.8.2High 7.5Jun 5Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50270fixed in 1.62.0High 7.5Jun 5Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50275fixed in 1.19.2High 8.2May 6Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltrationCVE-2026-44971no fix yetMedium 5.0May 6Unsanitized human-readable scan output allows terminal escape injection from malicious package contentCVE-2026-44972no fix yetCritical 9.3Mar 23Unsafe deserialization in dd-trace-java RMI instrumentation may lead to remote code executionCVE-2026-33728fixed in 1.60.3HighJan 13Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCECVE-2026-22871fixed in 2.7.1HighJan 13Zip Bomb Vulnerability in safe_extract() Allows DoSCVE-2026-22870fixed in 2.7.1High 7.0Nov 11, 2025Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissionsCVE-2025-61667fixed in 7.71.0Medium 6.2Jun 27, 2024Malformed unicode header values may throw uncaught exceptionCVE-2024-38525fixed in v0.2.2Medium 5.8Dec 5, 2022Arbitrary file write when scanning a specially-crafted remote PyPI packageCVE-2022-23530fixed in v0.1.8Medium 5.8Nov 29, 2022Arbitrary file write when scanning a specially-crafted local PyPI packageCVE-2022-23531fixed in v0.1.5LowFeb 24, 2021DataDog API Client contains a Local Information Disclosure VulnerabilityCVE-2021-21331fixed in 1.0.0-beta.9
About Datadog

Security advisories Datadog publishes for its own products.

Datadog

Datadog elsewhere on Ibis: Acquisitions · Quarterly · Paydays · Releases · Repos · TechConf