CVE-2024-38525

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the `nlohmann` JSON library. However, due to the way the JSON library is invoked, it throws an uncaught exception, which results in a crash. This vulnerability has been patched in version 0.2.2.

• CWE-20
• CWE-248

• https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.2
• https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-rf3p-mg22-qv6w
• https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.2
• https://github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-rf3p-mg22-qv6w

Published

Jun 28, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3852GetBoundName could return the wrong version of an object whe…7.5
• CVE-2024-38520SoftEtherVPN is a an open-source cross-platform multi-protoc…5.3
• CVE-2024-38521Hush Line is a free and open-source, anonymous-tip-line-as-a…6.1
• CVE-2024-38522Hush Line is a free and open-source, anonymous-tip-line-as-a…6.3
• CVE-2024-38523Hush Line is a free and open-source, anonymous-tip-line-as-a…7.5
• CVE-2024-38524GeoServer is an open source server that allows users to shar…7.5
• CVE-2024-38526pdoc provides API Documentation for Python Projects. Documen…7.2
• CVE-2024-38527ZenUML is JavaScript-based diagramming tool that requires no…5.4
• CVE-2024-38528nptd-rs is a tool for synchronizing your computer's clock, i…7.5
• CVE-2024-38529Admidio is a free, open source user management system for we…8.8
• CVE-2024-3853A use-after-free could result if a JavaScript realm was in t…7.5
• CVE-2024-38530The Open eClass platform (formerly known as GUnet eClass) is…9.8