# CVE-2026-116588: Datadog dd-trace-py regex DoS in query-string obfuscation

Source: https://junglewise.ai/threats/cve-2026-116588-datadog-dd-trace-py-is-the-datadog-python-apm-client-from-1-5-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116588 · Severity: high · CVSS 4 · Published 2026-10-26

Datadog's Python APM client (dd-trace-py) includes a vulnerable regular expression for obfuscating URL query strings in HTTP tracing data. An attacker can craft malicious URLs that cause excessive CPU consumption and service slowdowns due to regex backtracking, impacting applications using the default HTTP tracing integrations.

Technologies: [Datadog Dd-Trace-Py](https://junglewise.ai/threats/technologies/dd-trace-py), [ddtrace (PyPI)](https://junglewise.ai/threats/technologies/ddtrace). Vendors: [Datadog](https://junglewise.ai/threats/vendors/datadog), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-116588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116588 being exploited in the wild.

**How severe is CVE-2026-116588?** High severity, with a CVSS score of 4, published 26 October 2026.

**Which products and versions are affected?** Datadog Dd-Trace-Py 1.5.0 to 3.19.8, 4.0.0 to 4.15.5; ddtrace (PyPI) >= 1.5.0, < 3.19.9, ECOSYSTEM:introduced=1.5.0,fixed=3.19.9.

**Is there a fix for CVE-2026-116588?** Yes. ddtrace (PyPI): upgrade to 3.19.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116588 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116588?** Check whether you run Datadog Dd-Trace-Py or ddtrace (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ddtrace (PyPI): upgrade to 3.19.9 or later

  ```sh
  pip install "ddtrace>=3.19.9"
  ```


## Technical details

The default query-string obfuscation regex exhibits catastrophic backtracking when processing attacker-controlled URL query strings in HTTP span metadata. This vulnerability affects synchronous URL processing in HTTP tracing integrations enabled by default. Remote attackers can exploit this via crafted URLs to trigger prolonged CPU consumption and service unavailability.

## Affected products

- Datadog dd-trace-py 1.5.0 to 3.19.8, 4.0.0 to 4.15.5

## Identifiers

- CVE-2026-116588
- GHSA-3633-r77q-h3v3

## Timeline

- 2026-10-26: disclosed
- 2026-10-07: patched

## References

- [https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd](https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd)
- [https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce](https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce)

## Related threats

- [Datadog dd-trace-py process abort in IAST string formatting](https://junglewise.ai/threats/cve-2026-116589-datadog-dd-trace-py-is-the-datadog-python-apm-client-from-3-13-0)
- [Datadog dd-trace-py Denial of Service in W3C baggage parsing](https://junglewise.ai/threats/cve-2026-50271-datadog-dd-trace-py-denial-of-service-in-w3c-baggage-parsing)