Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities found for dd-trace-java by DataDog
CVE-2026-50270 (GCVE-0-2026-50270)
Vulnerability from nvd – Published: 2026-09-14 17:03 – Updated: 2026-09-14 19:16
VLAI
EPSS
VEX
Title
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:16 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-java/security… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-java/pull/11265 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-java/commit/1… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-java/releases… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-java |
Affected:
< 1.62.0
|
|
| com.datadoghq | dd-java-agent |
Affected:
< 1.62.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50270",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:16:34.436361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:16:55.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-java",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 1.62.0"
}
]
},
{
"product": "dd-java-agent",
"vendor": "com.datadoghq",
"versions": [
{
"status": "affected",
"version": "\u003c 1.62.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:03:39.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-74xj-wh4w-vqxc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-74xj-wh4w-vqxc"
},
{
"name": "https://github.com/DataDog/dd-trace-java/pull/11265",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/pull/11265"
},
{
"name": "https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757"
},
{
"name": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.62.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.62.0"
}
],
"source": {
"advisory": "GHSA-74xj-wh4w-vqxc",
"discovery": "UNKNOWN"
},
"title": "dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50270",
"datePublished": "2026-09-14T17:03:39.809Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-09-14T19:16:55.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33728 (GCVE-0-2026-33728)
Vulnerability from nvd – Published: 2026-03-27 00:25 – Updated: 2026-03-27 19:57
VLAI
EPSS
VEX
Title
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
Summary
dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, a JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable, Third, a gadget-chain-compatible library is present on the classpath. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK >= 8u121 < JDK 17, upgrade to dd-trace-java version 1.60.3 or later. For JDK < 8u121 and earlier where serialization filters are not available, apply the workaround. The workaround is to set the following environment variable to disable the RMI integration: `DD_INTEGRATION_RMI_ENABLED=false`.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 19:57 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-java/security… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-java/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-java |
Affected:
>= 0.40.0, < 1.60.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33728",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T19:57:15.250662Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T19:57:29.854Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-java",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.40.0, \u003c 1.60.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution.\u00a0All three of the following conditions must be true to exploit this vulnerability: First, dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, a JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable, Third, a gadget-chain-compatible library is present on the classpath. For JDK \u003e= 17, no action is required, but upgrading is strongly encouraged. For JDK \u003e= 8u121 \u003c JDK 17, upgrade to dd-trace-java version 1.60.3 or later. For JDK \u003c 8u121 and earlier where serialization filters are not available, apply the workaround. The workaround is to set the following environment variable to disable the RMI integration: `DD_INTEGRATION_RMI_ENABLED=false`."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T00:25:56.444Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-579q-h82j-r5v2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-579q-h82j-r5v2"
},
{
"name": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.60.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.60.3"
}
],
"source": {
"advisory": "GHSA-579q-h82j-r5v2",
"discovery": "UNKNOWN"
},
"title": "dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33728",
"datePublished": "2026-03-27T00:25:56.444Z",
"dateReserved": "2026-03-23T17:34:57.560Z",
"dateUpdated": "2026-03-27T19:57:29.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50270 (GCVE-0-2026-50270)
Vulnerability from cvelistv5 – Published: 2026-09-14 17:03 – Updated: 2026-09-14 19:16
VLAI
EPSS
VEX
Title
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
Summary
dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:16 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-java/security… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-java/pull/11265 | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-java/commit/1… | x_refsource_MISC |
| https://github.com/DataDog/dd-trace-java/releases… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-java |
Affected:
< 1.62.0
|
|
| com.datadoghq | dd-java-agent |
Affected:
< 1.62.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50270",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:16:34.436361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:16:55.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-java",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003c 1.62.0"
}
]
},
{
"product": "dd-java-agent",
"vendor": "com.datadoghq",
"versions": [
{
"status": "affected",
"version": "\u003c 1.62.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates map entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 1.62.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:03:39.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-74xj-wh4w-vqxc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-74xj-wh4w-vqxc"
},
{
"name": "https://github.com/DataDog/dd-trace-java/pull/11265",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/pull/11265"
},
{
"name": "https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/commit/16c6a5fd1fed71cef6c35f69122f19f5ee242757"
},
{
"name": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.62.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.62.0"
}
],
"source": {
"advisory": "GHSA-74xj-wh4w-vqxc",
"discovery": "UNKNOWN"
},
"title": "dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50270",
"datePublished": "2026-09-14T17:03:39.809Z",
"dateReserved": "2026-06-04T16:26:05.984Z",
"dateUpdated": "2026-09-14T19:16:55.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33728 (GCVE-0-2026-33728)
Vulnerability from cvelistv5 – Published: 2026-03-27 00:25 – Updated: 2026-03-27 19:57
VLAI
EPSS
VEX
Title
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
Summary
dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, a JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable, Third, a gadget-chain-compatible library is present on the classpath. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK >= 8u121 < JDK 17, upgrade to dd-trace-java version 1.60.3 or later. For JDK < 8u121 and earlier where serialization filters are not available, apply the workaround. The workaround is to set the following environment variable to disable the RMI integration: `DD_INTEGRATION_RMI_ENABLED=false`.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 19:57 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/DataDog/dd-trace-java/security… | x_refsource_CONFIRM |
| https://github.com/DataDog/dd-trace-java/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataDog | dd-trace-java |
Affected:
>= 0.40.0, < 1.60.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33728",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T19:57:15.250662Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T19:57:29.854Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dd-trace-java",
"vendor": "DataDog",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.40.0, \u003c 1.60.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution.\u00a0All three of the following conditions must be true to exploit this vulnerability: First, dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, a JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable, Third, a gadget-chain-compatible library is present on the classpath. For JDK \u003e= 17, no action is required, but upgrading is strongly encouraged. For JDK \u003e= 8u121 \u003c JDK 17, upgrade to dd-trace-java version 1.60.3 or later. For JDK \u003c 8u121 and earlier where serialization filters are not available, apply the workaround. The workaround is to set the following environment variable to disable the RMI integration: `DD_INTEGRATION_RMI_ENABLED=false`."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T00:25:56.444Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-579q-h82j-r5v2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-579q-h82j-r5v2"
},
{
"name": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.60.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DataDog/dd-trace-java/releases/tag/v1.60.3"
}
],
"source": {
"advisory": "GHSA-579q-h82j-r5v2",
"discovery": "UNKNOWN"
},
"title": "dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33728",
"datePublished": "2026-03-27T00:25:56.444Z",
"dateReserved": "2026-03-23T17:34:57.560Z",
"dateUpdated": "2026-03-27T19:57:29.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}