CVE-2026-116588
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Datadog dd-trace-py, the Datadog Python APM client, from 1.5.0 until 3.19.9 and 4.15.6 has a default query-string obfuscation regular expression that can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability.
Risk Assessment
A remote attacker can cause denial of service through CPU exhaustion in HTTP tracing integrations that process query strings by default. The risk affects applications with default HTTP tracing enabled.
Recommendation
Upgrade dd-trace-py to version 3.19.9 or 4.15.6 (or later). Until then, consider disabling or limiting inclusion of query strings in URL span tags.
Other vulnerabilities in dd-trace-py
See all- CVE-2026-116589High
Datadog dd-trace-py, the Datadog Python APM client, from 3.13.0 until 4.15.5 does not properly handle certain internal errors in IAST string-processing instrumentation when old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling.
- CVE-2026-50271High
The dd-trace-py (Python) library for Datadog does not enforce limits on the number or size of items in W3C baggage headers during extraction. A remote, unauthenticated attacker can send a request with an arbitrarily large number of key-value pairs or a single very large value, causing unbounded CPU and memory consumption.
Original NVD description (English source)
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS