Executive brief
Datadog's Java tracing library, used for monitoring application performance, contains a security flaw that could allow an attacker to take control of a server. If the library is used on older versions of Java (version 16 or earlier) and has certain management ports open to the network, an attacker could remotely execute malicious code. This could lead to a full system compromise, data theft, or service disruption.
Technical details
A deserialization of untrusted data vulnerability (CWE-502) exists in the RMI instrumentation of dd-trace-java. The library registers a custom endpoint that fails to apply serialization filters to incoming data. An attacker with network access to an explicitly configured JMX or RMI port can exploit this on JDK 16 and earlier to achieve remote code execution with the privileges of the JVM user. Exploitation requires the presence of a gadget-chain-compatible library on the classpath. The issue is fixed in version 1.60.3; users on older JDKs can also disable the RMI integration via environment variable.
Affected products
- Datadog dd-trace-java >= 0.40.0, < 1.60.3
Timeline
- 2026-03-23: patched: Version 1.60.3 released
- 2026-03-26: advisory: GitHub Advisory published
- 2026-03-27: disclosed: NVD publication date