CVE-2026-116588

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1333"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116588.json"
}

References

Affected packages

Git / github.com/datadog/dd-trace-py

Affected ranges

Type

GIT

Repo

https://github.com/datadog/dd-trace-py

Events

Introduced

7db021d5e0040b0168c03b071a4b4714eee18773

Fixed

63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd

Introduced

0303e58bea77f64f61e3888957e52257899c4adb

Fixed

83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce

Fixed

a6d73607ea45ecd67152630f64b0945556972ed8

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.5.0"
                },
                {
                    "fixed": "3.19.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.15.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "a6d73607ea45ecd67152630f64b0945556972ed8"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v3.19.9",
            "range": [
                {
                    "fixed": "63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v4.15.6",
            "range": [
                {
                    "fixed": "83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116588.json"