com.datadog.appsec.config.MergedAsmFeatures not Initialized

[andreniklasson]

Tracer Version(s)

1.51.0

Java Version(s)

21.0.7

JVM Vendor

Amazon Corretto

Bug Report

Hello!

We updated some of our Java services today with the latest (1.51.0) tracer agent and are suffering from NPE:s thrown here due to this.mergedAsmFeatures not being set.

The error output is:

java.lang.NullPointerException: Cannot invoke "com.datadog.appsec.config.MergedAsmFeatures.getMergedData()" because "this.mergedAsmFeatures" is null
at com.datadog.appsec.config.AppSecConfigServiceImpl.applyRemoteConfigListener(AppSecConfigServiceImpl.java:508)
at datadog.remoteconfig.DefaultConfigurationPoller.runConfigurationEndListener(DefaultConfigurationPoller.java:448)
at datadog.remoteconfig.DefaultConfigurationPoller.handleAgentResponse(DefaultConfigurationPoller.java:436)
at datadog.remoteconfig.DefaultConfigurationPoller.sendRequest(DefaultConfigurationPoller.java:343)
at datadog.remoteconfig.DefaultConfigurationPoller.poll(DefaultConfigurationPoller.java:243)
at datadog.trace.util.AgentTaskScheduler$PeriodicTask.run(AgentTaskScheduler.java:311)
at datadog.trace.util.AgentTaskScheduler$Worker.run(AgentTaskScheduler.java:266)
at java.base/java.lang.Thread.run(Thread.java:1583)

We are running the agent without any custom AppSec configuration. It seems this.mergedAsmFeatures is only initialized via init(), but applyRemoteConfigListener() can run before init() is triggered, leading to the NPE.

Expected Behavior

Ensure mergedAsmFeatures is initialized before calling applyRemoteConfigListener

Reproduction Code

No response

[manuel-alvarez-alvarez]

Hello @andreniklasson,

Thank you for bringing this issue to our attention. We've identified the underlying problem and are actively working on a fix. We'll keep you updated and notify you as soon as a patch release becomes available.

We apologize for any inconvenience this may have caused and appreciate your patience.

[RedVortex]

Hello, we're experiencing the same issue also with the latest version of the agent, this error wasn't present before. Since we pull the latest agent everytime we build and deploy an app, more and more of our apps are triggering this bug

Here's an example of what we see

[dd.trace 2025-07-11 10:31:59:971 -0400] [dd-remote-config] WARN datadog.remoteconfig.state.ProductState - Error processing config key employee/ASM_DD/37.recommended.json/config: null (Will not log warnings for 5 minutes)

java.lang.IllegalStateException
	at com.datadog.appsec.config.AppSecConfigServiceImpl$AppSecConfigChangesListener.accept(AppSecConfigServiceImpl.java:177)
	at com.datadog.appsec.config.AppSecConfigServiceImpl$AppSecConfigChangesDDListener.accept(AppSecConfigServiceImpl.java:222)
	at datadog.remoteconfig.state.ProductState.callListenerApplyTarget(ProductState.java:108)
	at datadog.remoteconfig.state.ProductState.apply(ProductState.java:72)
	at datadog.remoteconfig.DefaultConfigurationPoller.sendRequest(DefaultConfigurationPoller.java:343)
	at java.base/java.lang.Thread.run(Thread.java:1583)
	at datadog.trace.util.AgentTaskScheduler$PeriodicTask.run(AgentTaskScheduler.java:311)
	at datadog.trace.util.AgentTaskScheduler$Worker.run(AgentTaskScheduler.java:266)
	at datadog.remoteconfig.DefaultConfigurationPoller.handleAgentResponse(DefaultConfigurationPoller.java:428)
	at datadog.remoteconfig.DefaultConfigurationPoller.poll(DefaultConfigurationPoller.java:243)

[dd.trace 2025-07-11 10:31:59:974 -0400] [dd-remote-config] WARN datadog.remoteconfig.ConfigurationPoller - Error running configuration listener com.datadog.appsec.config.AppSecConfigServiceImpl$$Lambda/0x00007f2c5a2aea90@1378d91: Cannot invoke "com.datadog.appsec.config.MergedAsmFeatures.getMergedData()" because "this.mergedAsmFeatures" is null (Will not log warnings for 5 minutes)

java.lang.NullPointerException: Cannot invoke "com.datadog.appsec.config.MergedAsmFeatures.getMergedData()" because "this.mergedAsmFeatures" is null
	at com.datadog.appsec.config.AppSecConfigServiceImpl.applyRemoteConfigListener(AppSecConfigServiceImpl.java:508)
	at datadog.remoteconfig.DefaultConfigurationPoller.sendRequest(DefaultConfigurationPoller.java:343)
	at datadog.trace.util.AgentTaskScheduler$Worker.run(AgentTaskScheduler.java:266)
	at datadog.remoteconfig.DefaultConfigurationPoller.handleAgentResponse(DefaultConfigurationPoller.java:436)
	at datadog.remoteconfig.DefaultConfigurationPoller.poll(DefaultConfigurationPoller.java:243)
	at datadog.remoteconfig.DefaultConfigurationPoller.runConfigurationEndListener(DefaultConfigurationPoller.java:448)
	at datadog.trace.util.AgentTaskScheduler$PeriodicTask.run(AgentTaskScheduler.java:311)
	at java.base/java.lang.Thread.run(Thread.java:1583)

Thank you for looking at this.

[lmhajdukd]

Hi, any update on this ?

[manuel-alvarez-alvarez]

Hi, any update on this ?

Hello, we will try to release patch version 1.51.1 today, thank you for your patience.

[manuel-alvarez-alvarez]

Hello, we've just released v1.51.1 that should solve the issue. Again, thank you for your patience.

[RedVortex]

@manuel-alvarez-alvarez I confirm that 1.51.1 has fixed this issue for us, thanks a lot for the quickfix ! 👍

[smokeInCloud060201]

Hi @manuel-alvarez-alvarez Can release in maven repository, please? I can only find 1.50.0 in there

[manuel-alvarez-alvarez]

Hi @manuel-alvarez-alvarez Can release in maven repository, please? I can only find 1.50.0 in there

The tracer has now been published to Maven Central:
https://central.sonatype.com/artifact/com.datadoghq/dd-java-agent

Due to the sunset of OSSRH, we have updated our release process. Are you experiencing any issues with the new procedure?