CVE-2026-116589
Description
A flaw was found in ddtrace. This issue allows a remote attacker to cause a denial of service (DoS) when Interactive Application Security Testing (IAST) is enabled. Specifically, the string-processing instrumentation fails to handle internal errors during old-style string formatting operations. By submitting crafted input to an application performing these operations, an attacker can trigger an unhandled error that terminates the Python process.
Statement
Red Hat has evaluated this vulnerability as having a Moderate impact because exploitation requires non-default configuration settings alongside specific application-level coding patterns to cause a denial of service. The underlying issue in ddtrace only manifests when Interactive Application Security Testing (IAST) is explicitly turned on, which is disabled in default environments. Furthermore, an attacker must supply crafted input that is subsequently processed by old-style string interpolation within the monitored application. Because the flaw only causes process termination without compromising data confidentiality or system integrity, the overall risk remains bounded.
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
