CVE-2024-38525 Information

Description

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode it logs the list of audited headers and their values using the nlohmann JSON library. However due to the way the JSON library is invoked it throws an uncaught exception which results in a crash. This vulnerability has been patched in version 0.2.2.

Reference

https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-rf3p-mg22-qv6w https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.2