{"id":"CVE-2026-116588","kind":"vulnerability","aliases":["CVE-2026-116588"],"related":[],"title":"dd-trace-py: default query-string regex lets remote requests exhaust CPU","description":"Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.","summary":"The Datadog Python APM client (dd-trace-py) uses a default regular expression to obfuscate URL query strings in HTTP span metadata that can backtrack excessively. A remote attacker sending crafted query strings can drive up CPU use, add request latency and make the service unavailable.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apm","datadog","ddtrace","package","python"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed version with `pip show ddtrace`; affected versions are from `1.5.0` up to but not including `3.19.9` and `4.15.6`.\n- Look for `ddtrace` in `requirements.txt`, `pyproject.toml` or the lock file to confirm the pinned version.\n- Confirm HTTP tracing integrations are enabled, since the processing runs by default for them.","fix":"- Upgrade `ddtrace` to `3.19.9` on the 3.x line or `4.15.6` on the 4.x line.","status":"open","published_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:27:35+00:00","updated_at":"2026-10-26T22:27:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `ddtrace` to `3.19.9` on the 3.x line or `4.15.6` on the 4.x line.","reach":"internet","title":"dd-trace-py: default query-string regex lets remote requests exhaust CPU","impact":"low","summary":"The Datadog Python APM client (dd-trace-py) uses a default regular expression to obfuscate URL query strings in HTTP span metadata that can backtrack excessively. A remote attacker sending crafted query strings can drive up CPU use, add request latency and make the service unavailable.","category":"package","nicknames":[],"who_cares":["python","datadog","apm","ddtrace"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote requests make the service CPU-starved and unavailable.","analyst_note":"","how_to_check":"- Check the installed version with `pip show ddtrace`; affected versions are from `1.5.0` up to but not including `3.19.9` and `4.15.6`.\n- Look for `ddtrace` in `requirements.txt`, `pyproject.toml` or the lock file to confirm the pinned version.\n- Confirm HTTP tracing integrations are enabled, since the processing runs by default for them.","needs_analyst":false,"not_affected_if":["fixed-version"],"who_is_affected":"Python services that use dd-trace-py with an HTTP tracing integration that records URL query strings in span tags are exposed, because the vulnerable regex runs on attacker-controlled query strings by default. Services on versions before 1.5.0 are outside the stated range, and services already on the fixed versions are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000637,"input_tokens":3403,"output_tokens":594,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116588':17A,20A '-2026':16A,19A '1.5.0':85C '3.19.9':87C,157C '4.15.6':89C,159C 'add':65B 'affect':129C 'apm':21B,29B,82C 'attack':55B,106C,117C 'attacker-control':105C 'backtrack':51B,101C 'caus':119C 'client':30B,83C 'consumpt':122C 'control':107C 'cpu':14A,63B,121C 'craft':57B 'cve':15A,18A 'datadog':22B,27B,73C,80C 'dd':2A,32B,75C 'dd-trace-pi':1A,31B,74C 'ddtrace':23B 'default':5A,37B,91C,147C 'drive':61B 'enabl':145C 'excess':52B,100C 'exhaust':13A 'exhibit':99C 'express':39B,97C 'fix':154C 'http':46B,112C,130C 'includ':134C 'integr':132C,150C 'issu':152C 'latenc':67B,124C 'let':10A 'make':69B 'metadata':48B,114C 'obfusc':41B,95C 'packag':24B 'process':104C,143C 'prolong':120C 'py':4A,34B,77C 'python':25B,28B,81C 'queri':7A,43B,58B,93C,109C,135C 'query-str':6A,92C 'regex':9A 'regular':38B,96C 'remot':11A,54B,116C 'request':12A,66B,123C 'send':56B 'servic':71B,126C 'span':47B,113C,139C 'string':8A,44B,59B,94C,110C,136C 'synchron':103C 'tag':140C 'trace':3A,33B,76C,131C 'unavail':72B,127C 'url':42B,108C,138C 'use':35B,64B 'version':156C 'vulner':142C","nicknames":[],"mitigations":[],"who_affected":"Python services that use dd-trace-py with an HTTP tracing integration that records URL query strings in span tags are exposed, because the vulnerable regex runs on attacker-controlled query strings by default. Services on versions before 1.5.0 are outside the stated range, and services already on the fixed versions are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116588","severity":null,"published_at":"2026-10-26T22:16:55+00:00","modified_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}