Datadog dd-trace-py is the Datadog Python APM client.
CVE-2026-116588
Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DDTRACEOBFUSCATIONQUERYSTRINGREGEXP and DDTRACEOBFUSCATIONQUERYSTRINGPATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. export…
Assessment
- CVSS
- 8.7 (v4.0)
- Severity
- High
- EPSS
- 0.00468% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 27 October 2026
- Affected
- pip · ddtrace
- Weakness
- CWE-1333
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
At the source
References
- https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd
- https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce
- https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8
- https://github.com/DataDog/dd-trace-py/pull/20857
- https://github.com/DataDog/dd-trace-py/pull/20862
- https://github.com/DataDog/dd-trace-py/pull/20880
- https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9
- https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6
- https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3
- https://nvd.nist.gov/vuln/detail/CVE-2026-116588
- https://github.com/advisories/GHSA-3633-r77q-h3v3
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-116588