Zero Radar
← feed
HighVulnerabilityCVE-2026-116588updated 27 Oct 2026, 15:37 UTC

Datadog Python tracing library can be slowed to a crawl by crafted URLs

A specially crafted web address can make a Python app using Datadog tracing use huge amounts of CPU, slowing responses or making the service unavailable. Anyone who can send requests to the app can trigger it.

Fixed in ddtrace 3.19.9 and ddtrace 4.15.6Official, 2 sources
SeverityHighCVSS 8.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesddtrace 3.19.9 and ddtrace 4.15.6 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends a request with a crafted query string
  2. 2Python appRecords the URL for tracing
  3. 3Regex backtrackingObfuscation pattern burns CPU synchronously
  4. 4Service slowsRequests stall and become unavailable
  5. ResultService degrades or becomes unavailable

What happened

The default regular expression that obfuscates URL query strings in dd-trace-py suffers from excessive backtracking (ReDoS) and runs synchronously on attacker-controlled input during HTTP span recording.

Why it is dangerous: An attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations; this processing is enabled by default.

Are you affected?

You are affected if you run the Python dd-trace-py (ddtrace) library at version 1.5.0 up to 3.19.9, or 4.0.0 up to 4.15.6, with an HTTP tracing integration that records query strings in URL span tags.

Package / productAffected versionsFixed in
ddtrace · pip>= 1.5.0, < 3.19.93.19.9
ddtrace · pip>= 4.0.0, < 4.15.64.15.6

What to do

  1. Upgrade ddtrace to 3.19.9 (if on the 3.x line) or 4.15.6 (if on the 4.x line)
  2. If you cannot upgrade yet, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed regex from the advisory, then restart the application
  3. Restart the application after upgrading or changing the environment variables

Timeline

  1. 26 Oct 2026, 22:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 22:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 22:19 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 15:37 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 15:37 UTC
    Fixed version published: ddtrace 3.19.9, ddtrace 4.15.6 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116588 · GHSA-3633-r77q-h3v3
CVSS
8.7 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 22:16 UTC
On Zero Radar
26 Oct 2026, 22:19 UTC (3 min after disclosure)
Last change
27 Oct 2026, 15:37 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Datadog Python tracing library can be slowed to a crawl by crafted URLs · Zero Radar