Live › vulnerability › CVE-2026-116588
Go to dashboardThe Datadog Python APM client (dd-trace-py) uses a default regular expression to obfuscate URL query strings in HTTP span metadata that can backtrack excessively. A remote attacker sending crafted query strings can drive up CPU use, add request latency and make the service unavailable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Python services that use dd-trace-py with an HTTP tracing integration that records URL query strings in span tags are exposed, because the vulnerable regex runs on attacker-controlled query strings by default. Services on versions before 1.5.0 are outside the stated range, and services already on the fixed versions are not affected.
No product ranges from the sources yet.
pip show ddtrace; affected versions are from 1.5.0 up to but not including 3.19.9 and 4.15.6.ddtrace in requirements.txt, pyproject.toml or the lock file to confirm the pinned version.ddtrace to 3.19.9 on the 3.x line or 4.15.6 on the 4.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-116588")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.