Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-116588— Datadog dd-trace-py: ReDOS in URL query string obfuscation

Quick assessment

Affected

DataDog dd-trace-py

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Datadog dd-trace-py 是 Datadog 的 Python APM（应用性能监控）客户端。在版本 1.5.0 至 3.19.9 以及 4.15.6 之间，默认的查询字符串混淆正则表达式在同步处理攻击者可控的 HTTP 跨度（span）元数据中的 URL 查询字符串时，可能出现过度回溯问题。远程攻击者可利用此缺陷，导致受影响的 HTTP 追踪集成（其 URL 跨度标签中包含查询字符串）出现 CPU 长时间占用、请求延迟增加以及服务不可用。该漏洞处理机制在上述集成中默认启用。此问题已在版本 3.19.

CVSS 8.7 · High Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1499.001 · OS Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Datadog dd-trace-py: ReDOS in URL query string obfuscation

Source: CVE Program / CVE List V5

Vulnerability Description

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1333

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
DataDog	dd-trace-py	>= 1.5.0, < 3.19.9	-

II. Public POCs for CVE-2026-116588

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116588

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116588 (4)

Vendor Advisories for CVE-2026-116588 (1)

🔗 ReDOS in URL query string obfuscation · Advisory · DataDog/dd-trace-py · GitHub x_refsource_CONFIRM

Vendor Pages for CVE-2026-116588 (2)

🔗 Release 4.15.6 · DataDog/dd-trace-py · GitHub x_refsource_MISC
🔗 Release 3.19.9 · DataDog/dd-trace-py · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116588

IV. Related Vulnerabilities

Same product: dd-trace-py

Same vendor: DataDog

Same weakness: CWE-1333