CVE-2024-38525 dd-trace-cpp malformed unicode header values may cause crash
An attacker can cause a crash in the Datadog C++ tracing library by sending malformed unicode headers, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-38525?
CVE-2024-38525 is a high-severity denial of service vulnerability in DataDog dd-trace-cpp, published on 28 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the `nlohmann` JSON library. However, due to the way the JSON library is invoked, it throws an uncaught exception, which results in a crash. This vulnerability has been patched in version 0.2.2.
Which versions are affected by CVE-2024-38525?
How do I fix CVE-2024-38525?
No fix has been published for CVE-2024-38525 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-38525 being exploited?
There is no known exploitation of CVE-2024-38525 in the wild and no public exploit code.
Sources
Also known as GHSA-rf3p-mg22-qv6w.