CVE-2024-38525

Published: Jun 28, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the `nlohmann` JSON library. However, due to the way the JSON library is invoked, it throws an uncaught exception, which results in a crash. This vulnerability has been patched in version 0.2.2.

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Uncaught Exception

An exception is thrown from a function, but it is not caught.

References (4)

https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.2

Source: security-advisories@github.com

https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-rf3p-mg22-qv6w

Source: security-advisories@github.com

https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.2

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-rf3p-mg22-qv6w

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.