NullPointerException in AppSec - Cannot invoke "String.length()" because "string" is null #9346
Description
Tracer Version(s)
1.52.0
Java Version(s)
21.0.8
JVM Vendor
Amazon Corretto
Bug Report
Context
- We use Datadog tracer as a sidecar Docker container in AWS. Our Dockerfile always pulls the latest version from
https://dtdg.co/latest-java-tracer. - The exceptions are logged as INFO every few seconds.
- It started after a new deployment on August 7 at 3:29 PM (EDT). Our previous deployment was on August 6 at 6:06 PM (EDT). So the bug must have been introduced between those times, but the latest datadog tracer version was released on August 4 at 12:37 PM (EDT). Maybe the time it takes to deploy and distribute?
Stack trace
[dd.trace 2025-08-07 19:29:27:482 +0000] [http-nio-8080-exec-3] WARN com.datadog.appsec.event.EventDispatcher - AppSec callback exception
java.lang.NullPointerException: Cannot invoke "String.length()" because "string" is null
at datadog.okio.Buffer.writeUtf8(Buffer.java:966)
at com.squareup.moshi.JsonAdapter.fromJson(JsonAdapter.java:50)
at com.datadog.appsec.ddwaf.WAFModule.buildEvents(WAFModule.java:562)
at com.datadog.appsec.ddwaf.WAFModule.access$500(WAFModule.java:69)
at com.datadog.appsec.ddwaf.WAFModule$WAFDataCallback.onDataAvailable(WAFModule.java:403)
at com.datadog.appsec.event.EventDispatcher.publishDataEvent(EventDispatcher.java:148)
at com.datadog.appsec.event.ReplaceableEventProducerService.publishDataEvent(ReplaceableEventProducerService.java:29)
at com.datadog.appsec.gateway.GatewayBridge.maybePublishRequestData(GatewayBridge.java:1064)
at com.datadog.appsec.gateway.GatewayBridge.onRequestClientSocketAddress(GatewayBridge.java:566)
at datadog.trace.api.gateway.InstrumentationGateway$7.apply(InstrumentationGateway.java:289)
at datadog.trace.api.gateway.InstrumentationGateway$7.apply(InstrumentationGateway.java:284)
at datadog.trace.bootstrap.instrumentation.decorator.HttpServerDecorator.callIGCallbackAddressAndPort(HttpServerDecorator.java:571)
at datadog.trace.bootstrap.instrumentation.decorator.HttpServerDecorator.onRequest(HttpServerDecorator.java:310)
at datadog.trace.instrumentation.tomcat.TomcatDecorator.onRequest(TomcatDecorator.java:115)
at org.apache.catalina.connector.CoyoteAdapter.postParseRequest(CoyoteAdapter.java:845)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:339)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:397)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:905)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
at java.base/java.lang.Thread.run(Thread.java:1583)
Expected Behavior
Not having those logs spamming every few seconds.
Reproduction Code
Installing the Datadog agent as a sidecar Docker container in AWS as per the documentation says. We use Spring Boot in a Java app, but we do not have any Datadog package installed (just the sidecar container).