Is CVE-2026-116588 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116588 being exploited in the wild.

How severe is CVE-2026-116588?

High severity, with a CVSS score of 4, published 26 October 2026.

Which products and versions are affected?

Datadog Dd-Trace-Py 1.5.0 to 3.19.8, 4.0.0 to 4.15.5; ddtrace (PyPI) >= 1.5.0, < 3.19.9, ECOSYSTEM:introduced=1.5.0,fixed=3.19.9.

Is there a fix for CVE-2026-116588?

Yes. ddtrace (PyPI): upgrade to 3.19.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116588 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116588?

Check whether you run Datadog Dd-Trace-Py or ddtrace (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116588: Datadog dd-trace-py regex DoS in query-string obfuscation

Q: Is there a fix for CVE-2026-116588?

Yes. ddtrace (PyPI): upgrade to 3.19.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116588 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116588?

Check whether you run Datadog Dd-Trace-Py or ddtrace (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116588 · Severity: high · CVSS 4 · Published 2026-10-26

Datadog's Python APM client (dd-trace-py) includes a vulnerable regular expression for obfuscating URL query strings in HTTP tracing data. An attacker can craft malicious URLs that cause excessive CPU consumption and service slowdowns due to regex backtracking, impacting applications using the default HTTP tracing integrations.

Technologies: Datadog Dd-Trace-Py, ddtrace (PyPI). Vendors: Datadog, PyPI.

Quick answers

Is CVE-2026-116588 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116588 being exploited in the wild.
How severe is CVE-2026-116588?: High severity, with a CVSS score of 4, published 26 October 2026.
Which products and versions are affected?: Datadog Dd-Trace-Py 1.5.0 to 3.19.8, 4.0.0 to 4.15.5; ddtrace (PyPI) >= 1.5.0, < 3.19.9, ECOSYSTEM:introduced=1.5.0,fixed=3.19.9.
Is there a fix for CVE-2026-116588?: Yes. ddtrace (PyPI): upgrade to 3.19.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116588 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116588?: Check whether you run Datadog Dd-Trace-Py or ddtrace (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ddtrace (PyPI): upgrade to 3.19.9 or later
```
pip install "ddtrace>=3.19.9"
```

Technical details

The default query-string obfuscation regex exhibits catastrophic backtracking when processing attacker-controlled URL query strings in HTTP span metadata. This vulnerability affects synchronous URL processing in HTTP tracing integrations enabled by default. Remote attackers can exploit this via crafted URLs to trigger prolonged CPU consumption and service unavailability.

Affected products

Datadog dd-trace-py 1.5.0 to 3.19.8, 4.0.0 to 4.15.5

Identifiers

CVE-2026-116588
GHSA-3633-r77q-h3v3

Timeline

2026-10-26: disclosed
2026-10-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.