Skip to content

com.datadog.appsec.config.MergedAsmFeatures not Initialized #9159

Closed
Closed
com.datadog.appsec.config.MergedAsmFeatures not Initialized#9159
Labels
comp: asm wafApplication Security Management (WAF)type: bug reportBug report

Description

@andreniklasson
andreniklasson
opened on Jul 11, 2025

Tracer Version(s)

1.51.0

Java Version(s)

21.0.7

JVM Vendor

Amazon Corretto

Bug Report

Hello!

We updated some of our Java services today with the latest (1.51.0) tracer agent and are suffering from NPE:s thrown here due to this.mergedAsmFeatures not being set.

The error output is:

java.lang.NullPointerException: Cannot invoke "com.datadog.appsec.config.MergedAsmFeatures.getMergedData()" because "this.mergedAsmFeatures" is null
at com.datadog.appsec.config.AppSecConfigServiceImpl.applyRemoteConfigListener(AppSecConfigServiceImpl.java:508)
at datadog.remoteconfig.DefaultConfigurationPoller.runConfigurationEndListener(DefaultConfigurationPoller.java:448)
at datadog.remoteconfig.DefaultConfigurationPoller.handleAgentResponse(DefaultConfigurationPoller.java:436)
at datadog.remoteconfig.DefaultConfigurationPoller.sendRequest(DefaultConfigurationPoller.java:343)
at datadog.remoteconfig.DefaultConfigurationPoller.poll(DefaultConfigurationPoller.java:243)
at datadog.trace.util.AgentTaskScheduler$PeriodicTask.run(AgentTaskScheduler.java:311)
at datadog.trace.util.AgentTaskScheduler$Worker.run(AgentTaskScheduler.java:266)
at java.base/java.lang.Thread.run(Thread.java:1583)

We are running the agent without any custom AppSec configuration. It seems this.mergedAsmFeatures is only initialized via init(), but applyRemoteConfigListener() can run before init() is triggered, leading to the NPE.

Expected Behavior

Ensure mergedAsmFeatures is initialized before calling applyRemoteConfigListener

Reproduction Code

No response

Activity

  1. andreniklasson
    added
    type: bug fixBug fix
    on Jul 11, 2025
  2. smola
    added
    comp: asm wafApplication Security Management (WAF)
    on Jul 11, 2025

  3. manuel-alvarez-alvarez commented on Jul 11, 2025

    @manuel-alvarez-alvarez
    manuel-alvarez-alvarez
    on Jul 11, 2025
    Member

    Hello @andreniklasson,

    Thank you for bringing this issue to our attention. We've identified the underlying problem and are actively working on a fix. We'll keep you updated and notify you as soon as a patch release becomes available.

    We apologize for any inconvenience this may have caused and appreciate your patience.

  4. RedVortex commented on Jul 11, 2025

    @RedVortex
    RedVortex
    on Jul 11, 2025

    Hello, we're experiencing the same issue also with the latest version of the agent, this error wasn't present before. Since we pull the latest agent everytime we build and deploy an app, more and more of our apps are triggering this bug

    Here's an example of what we see

    [dd.trace 2025-07-11 10:31:59:971 -0400] [dd-remote-config] WARN datadog.remoteconfig.state.ProductState - Error processing config key employee/ASM_DD/37.recommended.json/config: null (Will not log warnings for 5 minutes)

java.lang.IllegalStateException
	at com.datadog.appsec.config.AppSecConfigServiceImpl$AppSecConfigChangesListener.accept(AppSecConfigServiceImpl.java:177)
	at com.datadog.appsec.config.AppSecConfigServiceImpl$AppSecConfigChangesDDListener.accept(AppSecConfigServiceImpl.java:222)
	at datadog.remoteconfig.state.ProductState.callListenerApplyTarget(ProductState.java:108)
	at datadog.remoteconfig.state.ProductState.apply(ProductState.java:72)
	at datadog.remoteconfig.DefaultConfigurationPoller.sendRequest(DefaultConfigurationPoller.java:343)
	at java.base/java.lang.Thread.run(Thread.java:1583)
	at datadog.trace.util.AgentTaskScheduler$PeriodicTask.run(AgentTaskScheduler.java:311)
	at datadog.trace.util.AgentTaskScheduler$Worker.run(AgentTaskScheduler.java:266)
	at datadog.remoteconfig.DefaultConfigurationPoller.handleAgentResponse(DefaultConfigurationPoller.java:428)
	at datadog.remoteconfig.DefaultConfigurationPoller.poll(DefaultConfigurationPoller.java:243)

[dd.trace 2025-07-11 10:31:59:974 -0400] [dd-remote-config] WARN datadog.remoteconfig.ConfigurationPoller - Error running configuration listener com.datadog.appsec.config.AppSecConfigServiceImpl$$Lambda/0x00007f2c5a2aea90@1378d91: Cannot invoke "com.datadog.appsec.config.MergedAsmFeatures.getMergedData()" because "this.mergedAsmFeatures" is null (Will not log warnings for 5 minutes)

java.lang.NullPointerException: Cannot invoke "com.datadog.appsec.config.MergedAsmFeatures.getMergedData()" because "this.mergedAsmFeatures" is null
	at com.datadog.appsec.config.AppSecConfigServiceImpl.applyRemoteConfigListener(AppSecConfigServiceImpl.java:508)
	at datadog.remoteconfig.DefaultConfigurationPoller.sendRequest(DefaultConfigurationPoller.java:343)
	at datadog.trace.util.AgentTaskScheduler$Worker.run(AgentTaskScheduler.java:266)
	at datadog.remoteconfig.DefaultConfigurationPoller.handleAgentResponse(DefaultConfigurationPoller.java:436)
	at datadog.remoteconfig.DefaultConfigurationPoller.poll(DefaultConfigurationPoller.java:243)
	at datadog.remoteconfig.DefaultConfigurationPoller.runConfigurationEndListener(DefaultConfigurationPoller.java:448)
	at datadog.trace.util.AgentTaskScheduler$PeriodicTask.run(AgentTaskScheduler.java:311)
	at java.base/java.lang.Thread.run(Thread.java:1583)

    Thank you for looking at this.

  5. lmhajdukd commented on Jul 15, 2025

    @lmhajdukd
    lmhajdukd
    on Jul 15, 2025

    Hi, any update on this ?

  6. manuel-alvarez-alvarez commented on Jul 15, 2025

    @manuel-alvarez-alvarez
    manuel-alvarez-alvarez
    on Jul 15, 2025
    Member

    Hi, any update on this ?

    Hello, we will try to release patch version 1.51.1 today, thank you for your patience.

  7. manuel-alvarez-alvarez commented on Jul 15, 2025

    @manuel-alvarez-alvarez
    manuel-alvarez-alvarez
    on Jul 15, 2025
    Member

    Hello, we've just released v1.51.1 that should solve the issue. Again, thank you for your patience.

  8. manuel-alvarez-alvarez
    closed this as completedon Jul 15, 2025

  9. RedVortex commented on Jul 15, 2025

    @RedVortex
    RedVortex
    on Jul 15, 2025

    @manuel-alvarez-alvarez I confirm that 1.51.1 has fixed this issue for us, thanks a lot for the quickfix ! 👍

  10. smokeInCloud060201 commented on Jul 17, 2025

    @smokeInCloud060201
    smokeInCloud060201
    on Jul 17, 2025

    Hi @manuel-alvarez-alvarez Can release in maven repository, please? I can only find 1.50.0 in there

  11. manuel-alvarez-alvarez commented on Jul 24, 2025

    @manuel-alvarez-alvarez
    manuel-alvarez-alvarez
    on Jul 24, 2025
    Member

    Hi @manuel-alvarez-alvarez Can release in maven repository, please? I can only find 1.50.0 in there

    The tracer has now been published to Maven Central:
    https://central.sonatype.com/artifact/com.datadoghq/dd-java-agent

    Due to the sunset of OSSRH, we have updated our release process. Are you experiencing any issues with the new procedure?

  12. PerfectSlayer
    added
    type: bug reportBug report
    and removed
    type: bug fixBug fix
    on Jul 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    comp: asm wafApplication Security Management (WAF)type: bug reportBug report

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions