CVE-2024-38525: Datadog Dd-Trace-Cpp

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the `nlohmann` JSON library. However, due to the way the JSON library is invoked, it throws an uncaught exception, which results in a crash. This vulnerability has been patched in version 0.2.2.

Affected products

• Datadog Dd-Trace-Cpp: from 0.1.12, before 0.2.2 (fixed in 0.2.2)
• Datadoghq Dd-Trace-Cpp: before 0.1.13 (fixed in 0.1.13); before 0.2.2 (fixed in 0.2.2)

Published 2024-06-28. Last modified 2026-06-17.