CVE-2026-116588
Received
Received - Intake
ReDoS in Datadog dd-trace-py via Query String Processing
Vulnerability report for CVE-2026-116588, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-26
Last updated on: 2026-10-26
Assigner: GitHub, Inc.
Description
Description
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| DataDog | dd-trace-py | >= 1.5.0, < 3.19.9 |
| DataDog | dd-trace-py | >= 4.0.0, < 4.15.6 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-1333 | The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential. |
