{"id":"CVE-2026-116588","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-116588","generatedAt":"2026-10-28T10:48:18.060Z","title":"From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata.","description":"Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.","published":"2026-10-26T22:16:55.000Z","lastModified":"2026-10-27T16:03:45.000Z","status":"Awaiting Analysis","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"4.0","score":8.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-1333"],"affected":[],"epss":{"score":0.00468,"percentile":0.40314,"date":"2026-10-27","history":[{"date":"2026-10-27","score":0.00468,"percentile":0.40314}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-26T22:16:55.000Z","detail":{"score":"8.7","severity":"HIGH","publishedAt":"2026-10-26T22:16:55.340Z"},"summary":"New CVE, high severity (CVSS 8.7)."}],"references":[{"url":"https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-py/pull/20857","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-py/pull/20862","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-py/pull/20880","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6","source":"security-advisories@github.com"},{"url":"https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-116588","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}