Cloudanix VulnDB

CVE-2026-116588

None

CVSS

—

EPSS

0.5%

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A monitoring tool used by Python web applications can be tricked by specially crafted web addresses into using so much processing power that services slow down or become unavailable.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Default regex for query-string obfuscation in dd-trace-py exhibits catastrophic backtracking on attacker-supplied URL query strings, causing synchronous high CPU consumption during HTTP span creation.

Why it matters to the business

Applications using Datadog Python tracing experience increased request latency and potential service outages when processing malicious query strings, affecting availability of monitored services.

How an attack unfolds

An attacker crafts a URL query string containing patterns that force excessive regex backtracking, includes it in HTTP requests to an instrumented endpoint, and triggers prolonged CPU usage in the tracing integration that processes query strings by default.

How to fix it

Upgrade dd-trace-py to version 3.19.9 or 4.15.6. Disable query-string collection in tracing configuration as a temporary mitigation if immediate upgrade is not possible.

How to confirm the fix worked

Confirm installed version is 3.19.9 or later (or 4.15.6 or later). Test with known backtracking query strings and verify absence of excessive CPU usage during span creation.

Typical attack path

  1. Identify an HTTP endpoint instrumented with vulnerable dd-trace-py version that tags query strings
  2. Generate query string payload designed to trigger catastrophic backtracking in the obfuscation regex
  3. Send repeated HTTP requests containing the malicious query string
  4. Observe sustained high CPU and increased latency in the traced service

How to detect it

Search application and Datadog tracer logs for high CPU events correlated with HTTP request processing; look for spans containing unusually long or complex query strings in metadata.

What your security team should do

  • Prioritize upgrade to fixed versions within the next maintenance window given public disclosure three days ago
  • Review Datadog tracing configuration to confirm whether query strings are collected and adjust if unnecessary
  • Monitor CPU and latency metrics for services using Python APM tracing

The record

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities