527 matches found
CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...
EUVD-2026-77670
dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...
CVE-2026-50270
dd-trace-java (Datadog APM client for Java) versions prior to 1.62.0 are vulnerable to a remote Denial of Service due to improper parsing of W3C baggage headers. The extraction path in BaggagePropagator.java allocates a hash-map entry for each comma-separated key-value pair without enforcing DD_T...
threatest
Threatest Threatest は、脅威検知をエンドツーエンドでテストするための CLI および Go フレームワークです。 Threatest を使用すると、攻撃手法を detonate し、期待するアラートがお好みのセキュリティプラットフォームで生成されたことを確認できます。 アナウンスブログ記事を読む: https://securitylabs.datadoghq.com/articles/threatest-end-to-end-testing-threat-detection/ 概念 デトネーター デトネーター は、攻撃手法をどこでどのように実行するかを記述します。...
stratus-red-team
Stratus Red Team Stratus Red Team 是云端的“Atomic Red Team™”，提供细粒度、自包含的进攻性攻击技术仿真。 公告博客文章： https://www.datadoghq.com/blog/cyber-attack-simulation-with-stratus-red-team/ https://blog.christophetd.fr/introducing-stratus-red-team-an-adversary-emulation-tool-for-the-cloud/ 快速入门 Stratus Red Team 是一个自包含的 Go...
security-labs-pocs
Datadog Security Labs 研究与概念验证代码 === 本仓库包含来自 Datadog Security Labs 的信息、漏洞利用、恶意软件样本和脚本。 目标 本仓库旨在提供概念验证漏洞利用、恶意软件样本和技术演示，以帮助社区应对威胁。本仓库中的代码可能用于： 改进检测 继续对战术、技术和程序 TTP 进行额外研究 发现更多漏洞利用 概念验证 Dirty Pipe 容器逃逸 JWT 空签名漏洞的利用与示例易受攻击应用 CVE-2022-21449 Spring Core RCE 又名 Spring4shell CVE-2022-22965 Confluence...
GHSA-7JXH-36Q5-GCQV vulnerabilities
Vulnerabilities for packages: k9s, helm-mapkubeapis, cluster-api-helm-controller-fips, kube-mgmt-fips, envoy-gateway-fips, livekit-cli, grype, manifest-tool, docker, docker-cli-buildx-fips, kube-arangodb-fips, helm-exporter-fips, kubevela-fips, newrelic-infrastructure-agent, helm-push, k8sgpt,...
CVE-2026-53495 vulnerabilities
Vulnerabilities for packages: k9s, helm-mapkubeapis, cluster-api-helm-controller-fips, kube-mgmt-fips, envoy-gateway-fips, livekit-cli, grype, manifest-tool, docker, docker-cli-buildx-fips, kube-arangodb-fips, helm-exporter-fips, kubevela-fips, newrelic-infrastructure-agent, helm-push, k8sgpt,...
dirtypipe-container-breakout-poc
Escape de contenedor Dirty Pipe Movido a https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/dirtypipe-container-breakout...
GHSA-5CC2-282F-JJQ2 vulnerabilities
Vulnerabilities for packages: datadog-agent...
CVE-2026-15925 vulnerabilities
Vulnerabilities for packages: datadog-agent...
GHSA-5CC2-282F-JJQ2 vulnerabilities
Vulnerabilities for packages: keep, mlrun, airflow, datadog-agent-fips, mlrun-fips, datadog-agent, keep-fips...
CVE-2026-15925 vulnerabilities
Vulnerabilities for packages: keep, mlrun, airflow, datadog-agent-fips, mlrun-fips, datadog-agent, keep-fips...
GHSA-GPWF-4H98-V82Q datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS
Impact Datadog tracing libraries that implement W3C Trace Context tracecontext propagation parse the incoming tracestate header without enforcing a size cap on the Datadog vendor entry dd=.... The dd= value contains semicolon-separated key:value pairs, and the parser allocates a hash-map entry fo...
EUVD-2026-67829
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, hubble-ui, fluent-operator, cluster-api-azure-controller, metrics-server, kubernetes-csi-external-snapshotter, kyverno-notation-aws, cert-manager, spicedb, flux-notification-controller, rancher, kubescape, spqr, kots, cloud-provider-aws,...
GO-2026-6003 vulnerabilities
Vulnerabilities for packages: gitlab-operator, datadog-agent-fips, tigera-operator, datadog-agent, gitlab-operator-fips, tigera-operator-fips...
GO-2026-6006 vulnerabilities
Vulnerabilities for packages: gitlab-operator, datadog-agent-fips, tigera-operator, datadog-agent, gitlab-operator-fips, tigera-operator-fips...