CVE-2026-116588

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

• CWE-1333

• https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd
• https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce
• https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8
• https://github.com/DataDog/dd-trace-py/pull/20857
• https://github.com/DataDog/dd-trace-py/pull/20862
• https://github.com/DataDog/dd-trace-py/pull/20880
• https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9
• https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6
• https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3

Published

Oct 26, 2026

Last Modified

Oct 27, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116582Seroval facilitates JavaScript value stringification, includ…4.7
• CVE-2026-116583Seroval facilitates JavaScript value stringification, includ…5.3
• CVE-2026-116584Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116585Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116586Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116587Go JOSE provides an implementation of the Javascript Object …7.5
• CVE-2026-116589Datadog dd-trace-py is the Datadog Python APM client. From 3…8.2
• CVE-2026-11659Integer overflow in UI in Google Chrome on Linux prior to 14…9.6
• CVE-2026-116590snappy-java is a Java port of the snappy, a fast C++ compres…5.9
• CVE-2026-116591compress provides various compression algorithms. Prior to 1…8.7
• CVE-2026-116593Apache Kafka Connect has the /connector-plugins/{connector-t…
• CVE-2026-116596Pyrus Sync for Windows contains a local privilege escalation…