CVE-2026-116588

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

CVSS

No CVSS.

References

Link	Resource
https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd
https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce
https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8
https://github.com/DataDog/dd-trace-py/pull/20857
https://github.com/DataDog/dd-trace-py/pull/20862
https://github.com/DataDog/dd-trace-py/pull/20880
https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9
https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6
https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3

Configurations

No configuration.

History

26 Oct 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-26 22:16

Updated : 2026-10-27 16:03

NVD link : CVE-2026-116588

Mitre link : CVE-2026-116588

CVE.ORG link : CVE-2026-116588

JSON object : View

Products Affected

No product.

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-116588", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "DataDog", "product": "dd-trace-py", "versions": [{"status": "affected", "version": ">= 1.5.0, < 3.19.9"}, {"status": "affected", "version": ">= 4.0.0, < 4.15.6"}]}]}], "published": "2026-10-26T22:16:55.340", "references": [{"url": "https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd", "source": "security-advisories@github.com"}, {"url": "https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce", "source": "security-advisories@github.com"}, {"url": "https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8", "source": "security-advisories@github.com"}, {"url": "https://github.com/DataDog/dd-trace-py/pull/20857", "source": "security-advisories@github.com"}, {"url": "https://github.com/DataDog/dd-trace-py/pull/20862", "source": "security-advisories@github.com"}, {"url": "https://github.com/DataDog/dd-trace-py/pull/20880", "source": "security-advisories@github.com"}, {"url": "https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9", "source": "security-advisories@github.com"}, {"url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6."}], "lastModified": "2026-10-27T16:03:45.247", "sourceIdentifier": "security-advisories@github.com"}