dd-trace-java vulnerabilities

2 known vulnerabilities in dd-trace-java from DataDog. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  dd-trace-java: Allocation of Resources Without Limits or Throttling

  CVE-2026-50270Sep 14, 2026DataDog

  dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injecti

• 9.8 Critical severity

  dd-trace-java: Deserialization of Untrusted Data

  CVE-2026-33728Mar 27, 2026DataDog

  dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earl