Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Security Compliance: CVE-2021-0341 (OkHttp 3.12.15) inside dd-java-agent fat JAR

Open
#11,631 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
java
Domain
security

Research direction

Start by inspecting the shaded dependency metadata at xx/dd-java-agent.jar/shared/META-INF/maven/com.datadoghq.okhttp3/okhttp/pom.properties and the build configuration that produces dd-java-agent.jar. Trace how OkHttp 3.12.15 is bundled, then verify that the agent uses a patched version and that the scanner no longer reports CVE-2021-0341.

Written by the indexing model from the issue text.

Description

type: bug report
Tracer Version(s)

1.63.0

Java Version(s)

25

JVM Vendor

Eclipse Adoptium / Temurin

Bug Report

Our enterprise container vulnerability scanner (Google Cloud Artifact Registry Scanner) is flagging a High Severity security vulnerability (CVE-2021-0341, CVSS 7.5) inside the bundled dependencies of dd-java-agent.jar.

The scan specifically isolates the vulnerable code inside the internal shaded namespace folder structure of the agent.

Environment
  • Datadog Java Agent Version: 1.63.0 (and 1.60.3)
  • Java Version: 25
  • Vulnerability Scanner: Google Artifact Registry / Container Scanner (OS Config / Trivy-based)
Flagged Path Evidence

The scanner explicitly unpacks the container layer and identifies the embedded tracking properties here:
xx/dd-java-agent.jar/shared/META-INF/maven/com.datadoghq.okhttp3/okhttp/pom.properties

The configuration inside indicates that the underlying engine is relying on OkHttp 3.12.15, which contains the known CVE-2021-0341 validation flaw. This requires a baseline migration to OkHttp 4.9.2+ (or a secure, patched 3.x branch) to clear the signature.

Impact

While we understand that this library is shaded under the com.datadoghq.okhttp3 namespace and heavily isolated from our main application code paths, modern binary fingerprinting scanners look at the class signatures directly.

Because it is classified as a High severity finding, our automated company CI/CD quality

Expected Behavior

The shaded HTTP transport utility inside dd-java-agent should be bumped to a safe version

Reproduction Code

No response

Dominant language
Java
Stars
737
Forks
361
Avg merge
3d 20h
Merged PRs (30d)
173

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from DataDog/dd-trace-java

All issues in DataDog/dd-trace-java

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.