Vendor

    Datadog

    29 known vulnerabilities in products by Datadog, 0 of them actively exploited (CISA KEV).

    Key figures

    29

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Datadog
    CriticalCVE-2026-22871

    GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE

    also in 1 other product

    		9.8
    HighCVE-2026-50277

    dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

    		7.5
    HighCVE-2026-50276

    dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

    		7.5
    HighCVE-2026-50270

    dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

    		7.5
    CriticalCVE-2026-33728

    dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution

    		9.8
    HighCVE-2026-54788

    dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS

    		7.5
    HighCVE-2026-50275

    Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

    		7.5
    HighCVE-2026-116588

    Datadog dd-trace-py: ReDOS in URL query string obfuscation

    		—
    HighCVE-2026-116693

    dd-trace: ReDOS in URL query string obfuscation

    		—
    HighCVE-2026-50274

    dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS

    also in 1 other product

    		7.5
    HighCVE-2026-50272

    dd-trace: Improper parsing of W3C baggage headers may lead to DoS

    		7.5
    HighCVE-2026-50271

    dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

    		7.5
    HighCVE-2026-50273

    Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS

    		7.5
    HighCVE-2026-116589

    Datadog dd-trace-py: IAST instrumentation can lead to application DOS

    		—
    CriticalCVE-2023-38704

    import-in-the-middle allows unsanitized user controlled input in module generation

    also in 1 other product

    		8.1
    MediumCVE-2026-47364

    Datadog Android App: Exposure of Sensitive Information to an Unauthorized Actor

    		6.5
    HighCVE-2026-22870

    GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS

    also in 1 other product

    		7.5
    MediumCVE-2026-44964

    Datadog Android App: Confused Deputy

    		6.5
    HighCVE-2026-44971

    Datadog Guarddog: Server-Side Request Forgery (SSRF)

    		8.2
    MediumCVE-2026-47361

    Datadog Android App: Improper Export of Android Application Components

    		6.4
    MediumCVE-2026-47363

    Datadog Android App: Improper Export of Android Application Components

    		6.3
    MediumCVE-2022-23530

    GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package

    also in 1 other product

    		5.8
    HighCVE-2022-23531

    Arbitrary file write when scanning a specially-crafted local PyPI package

    also in 1 other product

    		5.8
    HighCVE-2024-38525

    dd-trace-cpp malformed unicode header values may cause crash

    		7.5
    MediumCVE-2026-44965

    Datadog Android App: Improper Export of Android Application Components

    		5.5

    All vulnerabilities in search

    Products

    Products by Datadog
    Android App60
    Guarddog60
    Dd-trace-py30