CVE-2026-116588
Datadog dd-trace-py is the Datadog Python APM client
- Risk score
- 67/100
- CVSS
- 8.7 v4.0
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Datadog Python APM client has a vulnerability in its default query-string obfuscation regular expression, which can cause prolonged CPU consumption and request latency when processing attacker-controlled URL query strings.
- Affected
- {'products': ['Datadog'], 'packages': ['dd-trace-py'], 'versions': ['1.5.0-3.19.9', '4.15.6']}
- Fix
- Upgrade to versions 3.19.9 and 4.15.6
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.7 high
- Remotely exploitable without logging in
- On your watchlist: python
References
- https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd
- https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce
- https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8
- https://github.com/DataDog/dd-trace-py/pull/20857
- https://github.com/DataDog/dd-trace-py/pull/20862
- https://github.com/DataDog/dd-trace-py/pull/20880
- https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9
- https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6
- https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3
Original description
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.
Last activity 26 Oct 2026. Patch Forecast updates every hour.