CVE-2026-116588: Datadog dd-trace-py: ReDoS in URL query string obfuscation
A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations.
References
- github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd
- github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce
- github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8
- github.com/DataDog/dd-trace-py/pull/20857
- github.com/DataDog/dd-trace-py/pull/20862
- github.com/DataDog/dd-trace-py/pull/20880
- github.com/DataDog/dd-trace-py/releases/tag/v3.19.9
- github.com/DataDog/dd-trace-py/releases/tag/v4.15.6
- github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3
- github.com/advisories/GHSA-3633-r77q-h3v3
- nvd.nist.gov/vuln/detail/CVE-2026-116588
Code Behaviors & Features
Detect and mitigate CVE-2026-116588 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →