CVE-2026-116588

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116588", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-26T15:03:39.036Z", "datePublished": "2026-10-26T21:22:46.130Z", "dateUpdated": "2026-11-02T18:14:38.663Z"}, "containers": {"cna": {"title": "Datadog dd-trace-py: ReDOS in URL query string obfuscation", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3"}, {"name": "https://github.com/DataDog/dd-trace-py/pull/20857", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/pull/20857"}, {"name": "https://github.com/DataDog/dd-trace-py/pull/20862", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/pull/20862"}, {"name": "https://github.com/DataDog/dd-trace-py/pull/20880", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/pull/20880"}, {"name": "https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd"}, {"name": "https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce"}, {"name": "https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8"}, {"name": "https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9"}, {"name": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6"}], "affected": [{"vendor": "DataDog", "product": "dd-trace-py", "versions": [{"version": ">= 1.5.0, < 3.19.9", "status": "affected"}, {"version": ">= 4.0.0, < 4.15.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-26T21:22:46.130Z"}, "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6."}], "source": {"advisory": "GHSA-3633-r77q-h3v3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T18:13:55.370431Z", "id": "CVE-2026-116588", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T18:14:38.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116588", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T18:13:55.370431Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T18:14:32.010Z"}}], "cna": {"title": "Datadog dd-trace-py: ReDOS in URL query string obfuscation", "source": {"advisory": "GHSA-3633-r77q-h3v3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "DataDog", "product": "dd-trace-py", "versions": [{"status": "affected", "version": ">= 1.5.0, < 3.19.9"}, {"status": "affected", "version": ">= 4.0.0, < 4.15.6"}]}], "references": [{"url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3", "name": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/DataDog/dd-trace-py/pull/20857", "name": "https://github.com/DataDog/dd-trace-py/pull/20857", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-py/pull/20862", "name": "https://github.com/DataDog/dd-trace-py/pull/20862", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-py/pull/20880", "name": "https://github.com/DataDog/dd-trace-py/pull/20880", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd", "name": "https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce", "name": "https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8", "name": "https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9", "name": "https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6", "name": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-26T21:22:46.130Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116588", "state": "PUBLISHED", "dateUpdated": "2026-11-02T18:14:38.663Z", "dateReserved": "2026-10-26T15:03:39.036Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-26T21:22:46.130Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dd-trace-py", "vendor": "DataDog", "versions": [{"status": "affected", "version": ">= 1.5.0, < 3.19.9"}, {"status": "affected", "version": ">= 4.0.0, < 4.15.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6."}], "id": "CVE-2026-116588", "lastModified": "2026-11-02T19:17:56.430", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116588", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T18:13:55.370431Z", "version": "2.0.3"}}]}, "published": "2026-10-26T22:16:55.340", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/pull/20857"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/pull/20862"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/pull/20880"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ddtrace: dd-trace-py: Denial of Service via regular expression backtracking", "id": "2561439", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561439"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.", "A flaw was found in dd-trace-py. The default regular expression used for query-string obfuscation can encounter excessive backtracking when processing input for HTTP tracing metadata. A remote attacker can exploit this vulnerability by submitting specially crafted URL query strings, resulting in prolonged CPU consumption and leading to a Denial of Service (DoS)."], "name": "CVE-2026-116588", "public_date": "2026-10-26T21:22:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116588\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116588\nhttps://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd\nhttps://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce\nhttps://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8\nhttps://github.com/DataDog/dd-trace-py/pull/20857\nhttps://github.com/DataDog/dd-trace-py/pull/20862\nhttps://github.com/DataDog/dd-trace-py/pull/20880\nhttps://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9\nhttps://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6\nhttps://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3"], "statement": "This vulnerability is rated as having an Important impact because unauthenticated remote attackers can exhaust application CPU resources and cause complete denial of service without requiring privileges. In affected Python services instrumented with Datadog APM tracing, HTTP request spans sanitize incoming query parameters synchronously using a vulnerable backtracking pattern by default. The issue affects services running vulnerable dd-trace-py integrations that record URL query parameters in span metadata, though confidentiality and system integrity remain unaffected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.5.0,3.19.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.15.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "dd-trace-py", "source": "cna", "vendor": "DataDog"}, "product": "dd-trace-py", "vendor": "datadog"}], "created": "2026-10-27T05:45:14.346510+00:00", "updated": "2026-10-27T07:15:08.220642+00:00", "vendors": ["datadog", "datadog$PRODUCT$dd-trace-py"]}