CVE-2026-116588 in dd-trace-py
Summary
by MITRE • 10/27/2026
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The Datadog dd-trace-py library serves as the primary Application Performance Monitoring client for Python applications, providing critical observability into service performance and behavior. A significant security vulnerability exists within this agent regarding its default configuration for handling HTTP request metadata. Specifically, from version 1.5.0 through versions 3.19.9 and 4.15.6, the library employs a regular expression designed to obfuscate query strings found in URL span tags. This feature is intended to prevent sensitive data such as passwords or tokens from being stored in plain text within monitoring dashboards. However, the implementation of this regex-based sanitization mechanism contains a critical flaw that allows for Regular Expression Denial of Service attacks against the tracing agent itself.
The technical root cause lies in excessive backtracking inherent in the regular expression pattern used to identify and mask query string parameters. When the library processes HTTP requests containing attacker-controlled URL query strings, it synchronously applies this regex operation during span creation. Because the processing is synchronous and occurs on the main execution thread of the application or agent, a maliciously crafted input can trigger catastrophic performance degradation. The regular expression engine enters an exponential time complexity loop when faced with specific patterns designed to exploit backtracking vulnerabilities. This results in the CPU core being consumed entirely by the regex evaluation process for an extended period, effectively halting other operations within that thread.
The operational impact of this vulnerability is severe and directly affects service availability. Since the tracing integration processes incoming HTTP requests synchronously, a single malicious request can cause prolonged high CPU consumption on the host running the application or agent. This resource exhaustion leads to significant increases in request latency for legitimate traffic and can ultimately result in complete service unavailability as the process becomes unresponsive. The vulnerability is particularly dangerous because it requires no authentication; any remote attacker capable of sending HTTP requests with crafted query strings to an instrumented endpoint can trigger this denial-of-service condition. This affects all integrations that include query strings in URL span tags, which are enabled by default in most standard configurations.
From a classification perspective, this vulnerability aligns with CWE-400, Uncontrolled Resource Consumption, as the attacker controls input that leads to excessive resource usage. It also maps to MITRE ATT&CK technique T1496, Resource Hijacking, where an adversary uses resources of a compromised system for their own purposes or causes disruption through denial-of-service. The attack vector is classified under Network Access with Low Complexity, as it relies on sending specific HTTP requests rather than exploiting complex configuration errors or requiring local access.
Mitigation strategies focus primarily on upgrading the affected software to patched versions where this regular expression has been optimized or replaced to prevent backtracking issues. Organizations should upgrade dd-trace-py to version 3.19.9, version 4.15.6, or any later release that includes the fix for this specific regex flaw. In environments where immediate upgrading is not feasible, administrators can consider disabling query string obfuscation in span tags if security policies allow storing raw query strings, thereby removing the vulnerable code path entirely. Alternatively, implementing a Web Application Firewall to sanitize incoming request parameters before they reach the application layer can prevent malicious payloads from triggering the vulnerability within the tracing agent. Regular monitoring of CPU usage on hosts running instrumented applications is also recommended to detect potential exploitation attempts early.