# Datadog vulnerabilities Source: https://junglewise.ai/threats/vendors/datadog Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/datadog.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in Datadog: 0 in the last 7 days and 9 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116693, was published on 27 October 2026. 3 vulnerabilities in the last four weeks, down 40% on the four before (5). 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 9 - All time: 18 (1 critical, 0 exploited in the wild) ## About Datadog Datadog is an observability service for cloud-scale applications, providing monitoring of servers, databases, tools, and services through a SaaS-based data analytics platform. ## Latest Datadog vulnerabilities - [CVE-2026-116693: Datadog dd-trace ReDoS in query string obfuscation regex](https://junglewise.ai/threats/cve-2026-116693-dd-trace-is-the-datadog-apm-client-for-node-js-from-2-0-0-until) (high, CVSS 4, published 27 Oct 2026) - [CVE-2026-116589: Datadog dd-trace-py process abort in IAST string formatting](https://junglewise.ai/threats/cve-2026-116589-datadog-dd-trace-py-is-the-datadog-python-apm-client-from-3-13-0) (high, CVSS 4, published 26 Oct 2026) - [CVE-2026-116588: Datadog dd-trace-py regex DoS in query-string obfuscation](https://junglewise.ai/threats/cve-2026-116588-datadog-dd-trace-py-is-the-datadog-python-apm-client-from-1-5-0) (high, CVSS 4, published 26 Oct 2026) - [CVE-2026-77620: Vector logstash source denial of service via nested compression](https://junglewise.ai/threats/cve-2026-77620-vector-is-a-high-performance-observability-data-pipeline-from-0) (info, published 22 Sep 2026) - [CVE-2026-50277: Datadog dd-trace-cpp denial of service in baggage header extraction](https://junglewise.ai/threats/cve-2026-50277-datadog-dd-trace-cpp-denial-of-service-in-baggage-header) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-50275: Datadog PHP Tracer denial of service via unbounded baggage parsing](https://junglewise.ai/threats/cve-2026-50275-datadog-php-tracer-denial-of-service-via-unbounded-baggage) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-50276: Datadog dd-trace-rb denial of service in W3C baggage parsing](https://junglewise.ai/threats/cve-2026-50276-datadog-dd-trace-rb-denial-of-service-in-w3c-baggage-parsing) (high, CVSS 7.5, published 14 Sep 2026) - [CVE-2026-50270: Datadog dd-trace-java denial of service via W3C baggage headers](https://junglewise.ai/threats/cve-2026-50270-datadog-dd-trace-java-denial-of-service-via-w3c-baggage-headers) (high, CVSS 7.5, published 14 Sep 2026) - [CVE-2026-54788: Datadog dd-trace-rs unbounded W3C tracestate parsing DoS](https://junglewise.ai/threats/cve-2026-54788-datadog-dd-trace-rs-unbounded-w3c-tracestate-parsing-dos) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-50274: Datadog dd-trace-go denial of service in W3C baggage header parsing](https://junglewise.ai/threats/cve-2026-50274-datadog-dd-trace-go-denial-of-service-in-w3c-baggage-header) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-50272: DataDog dd-trace-js denial of service via unbounded baggage extraction](https://junglewise.ai/threats/cve-2026-50272-datadog-dd-trace-js-denial-of-service-via-unbounded-baggage) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-50271: Datadog dd-trace-py Denial of Service in W3C baggage parsing](https://junglewise.ai/threats/cve-2026-50271-datadog-dd-trace-py-denial-of-service-in-w3c-baggage-parsing) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-50273: Datadog .NET Tracer Denial of Service in W3C baggage parsing](https://junglewise.ai/threats/cve-2026-50273-datadog-net-tracer-denial-of-service-in-w3c-baggage-parsing) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-39197: Datadog Vector Denial of Service via memory exhaustion in HTTP and gRPC ingest](https://junglewise.ai/threats/cve-2026-39197-datadog-vector-denial-of-service-via-memory-exhaustion-in-http) (info, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-39196: Datadog Vector SQL injection in ClickHouse sink KeyPartitioner](https://junglewise.ai/threats/cve-2026-39196-datadog-vector-sql-injection-in-clickhouse-sink-keypartitioner) (info, CVSS 0, published 15 Jun 2026) - [CVE-2026-9270: DataDog DogStatsd metric injection in Perl library](https://junglewise.ai/threats/cve-2026-9270-datadog-dogstatsd-metric-injection-in-perl-library) (info, published 5 Jun 2026) - [CVE-2026-11362: DataDog DogStatsd metric injection in Perl library event tags](https://junglewise.ai/threats/cve-2026-11362-datadog-dogstatsd-metric-injection-in-perl-library-event-tags) (info, published 5 Jun 2026) - [CVE-2026-33728: Datadog dd-trace-java unsafe deserialization in RMI instrumentation](https://junglewise.ai/threats/cve-2026-33728-datadog-dd-trace-java-unsafe-deserialization-in-rmi) (critical, CVSS 9.8, published 27 Mar 2026) ## Most severe Datadog vulnerabilities - [CVE-2026-33728: Datadog dd-trace-java unsafe deserialization in RMI instrumentation](https://junglewise.ai/threats/cve-2026-33728-datadog-dd-trace-java-unsafe-deserialization-in-rmi) (critical, CVSS 9.8, published 27 Mar 2026) - [CVE-2026-50277: Datadog dd-trace-cpp denial of service in baggage header extraction](https://junglewise.ai/threats/cve-2026-50277-datadog-dd-trace-cpp-denial-of-service-in-baggage-header) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-50276: Datadog dd-trace-rb denial of service in W3C baggage parsing](https://junglewise.ai/threats/cve-2026-50276-datadog-dd-trace-rb-denial-of-service-in-w3c-baggage-parsing) (high, CVSS 7.5, published 14 Sep 2026) - [CVE-2026-50270: Datadog dd-trace-java denial of service via W3C baggage headers](https://junglewise.ai/threats/cve-2026-50270-datadog-dd-trace-java-denial-of-service-via-w3c-baggage-headers) (high, CVSS 7.5, published 14 Sep 2026) - [CVE-2026-54788: Datadog dd-trace-rs unbounded W3C tracestate parsing DoS](https://junglewise.ai/threats/cve-2026-54788-datadog-dd-trace-rs-unbounded-w3c-tracestate-parsing-dos) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-50274: Datadog dd-trace-go denial of service in W3C baggage header parsing](https://junglewise.ai/threats/cve-2026-50274-datadog-dd-trace-go-denial-of-service-in-w3c-baggage-header) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-50272: DataDog dd-trace-js denial of service via unbounded baggage extraction](https://junglewise.ai/threats/cve-2026-50272-datadog-dd-trace-js-denial-of-service-via-unbounded-baggage) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-50271: Datadog dd-trace-py Denial of Service in W3C baggage parsing](https://junglewise.ai/threats/cve-2026-50271-datadog-dd-trace-py-denial-of-service-in-w3c-baggage-parsing) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-50273: Datadog .NET Tracer Denial of Service in W3C baggage parsing](https://junglewise.ai/threats/cve-2026-50273-datadog-net-tracer-denial-of-service-in-w3c-baggage-parsing) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-50275: Datadog PHP Tracer denial of service via unbounded baggage parsing](https://junglewise.ai/threats/cve-2026-50275-datadog-php-tracer-denial-of-service-via-unbounded-baggage) (high, CVSS 7.5, published 17 Sep 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 40% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Datadog technologies - [Datadog Dd-Trace-Py](https://junglewise.ai/threats/technologies/dd-trace-py): 3 vulnerabilities - [Datadog Vector](https://junglewise.ai/threats/technologies/vector): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Datadog vulnerabilities", https://junglewise.ai/threats/vendors/datadog, 9 November 2026.