All vulnerabilities
CVE-2026-116588GHSA-3633-r77q-h3v3

Datadog dd-trace-py: ReDOS in URL query string obfuscation

DataDog dd-trace-py
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

Text from CVE List

Affected versions 2

  • dd-trace-pyaffected: >= 1.5.0, < 3.19.9CVE List
  • dd-trace-pyaffected: >= 4.0.0, < 4.15.6CVE List

References 9