---
id: "CVE-2026-116588"
kind: "vulnerability"
aliases: ["CVE-2026-116588"]
title: "dd-trace-py: default query-string regex lets remote requests exhaust CPU"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apm", "datadog", "ddtrace", "package", "python"]
not_affected_if: ["fixed-version"]
published_at: "2026-10-26T22:16:55+00:00"
first_seen_at: "2026-10-26T22:25:33+00:00"
updated_at: "2026-10-26T22:27:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116588", "first_seen_at": "2026-10-26T22:25:33+00:00"}]
---

# dd-trace-py: default query-string regex lets remote requests exhaust CPU

The Datadog Python APM client (dd-trace-py) uses a default regular expression to obfuscate URL query strings in HTTP span metadata that can backtrack excessively. A remote attacker sending crafted query strings can drive up CPU use, add request latency and make the service unavailable.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show ddtrace`; affected versions are from `1.5.0` up to but not including `3.19.9` and `4.15.6`.
- Look for `ddtrace` in `requirements.txt`, `pyproject.toml` or the lock file to confirm the pinned version.
- Confirm HTTP tracing integrations are enabled, since the processing runs by default for them.

## Fix

- Upgrade `ddtrace` to `3.19.9` on the 3.x line or `4.15.6` on the 4.x line.

## Timeline

- 2026-10-26T22:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116588

## From the sources

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_