Datadog dd-trace-py up to 3.19.8/4.15.5 Query String Obfuscation incorrect bitwise shift of integer

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Datadog dd-trace-py up to 3.19.8/4.15.5. This affects an unknown part of the component Query String Obfuscation. The manipulation leads to incorrect bitwise shift of integer. This vulnerability is documented as CVE-2026-116588. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Datadog dd-trace-py up to 3.19.8/4.15.5. This issue affects an unknown functionality of the component Query String Obfuscation. The manipulation with an unknown input leads to a incorrect bitwise shift of integer vulnerability. Using CWE to declare the problem leads to CWE-1335. An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result. Impacted is availability. The summary by CVE is:

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-116588 since 10/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.19.9 or 4.15.6 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Datadog

Name

• dd-trace-py

Version

• 3.19.0
• 3.19.1
• 3.19.2
• 3.19.3
• 3.19.4
• 3.19.5
• 3.19.6
• 3.19.7
• 3.19.8
• 4.15.0
• 4.15.1
• 4.15.2
• 4.15.3
• 4.15.4
• 4.15.5

Website

• Product: https://github.com/DataDog/dd-trace-py/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion