CVE-2026-116588

The Datadog dd-trace-py Python APM client (versions 1.5.0 through 3.19.9 and 4.15.6) is vulnerable to a Regular Expression Denial of Service (ReDOS) . The flaw exists in the default query-string obfuscation regular expression, which can undergo excessive backtracking when synchronously processing...

CVE-2026-116588 Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

CVE-2026-116588 Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

ROOT-APP-PYPI-CVE-2025-69224 CVE-2025-69224 in aiohttp - Patched by Root

Root has patched CVE-2025-69224 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

PT-2026-125468

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

PT-2026-125469

Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...

AZL-111098 CVE-2026-115557 affecting package python-py 1.11.0-1

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration...

pkg-15903 (>=0.1.10, <=0.1.18), py-package-updater (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2026-113717 via virtualenv (20.29.3)

virtualenv PYPI version 20.29.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pkg-15903 =0.1.10, =0.1.1, =0.1.1, =1.0.9 - ten8t 0.0.22 - tidyfiles 0.6.3 Source cves: CVE-2026-113717 Source advisory:...

cashu (0.15.1), cfg-analysis-tool-py (0.1.0) +7 more potentially affected by CVE-2026-113717 via virtualenv (20.25.0)

virtualenv PYPI version 20.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cashu 0.15.1 - cfg-analysis-tool-py 0.1.0 - edx-repo-tools 0.8.3 - mamba-toolbox =1.2.5.22, =0.2.1, =2.0.2, =0.1.15, =0.0.7, =0.0.8 Source...

chemscad (2.0.3), pcapprocessor (0.1.0) +3 more potentially affected by CVE-2026-113717 via virtualenv (20.8.1)

virtualenv PYPI version 20.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chemscad 2.0.3 - pcapprocessor 0.1.0 - pickley =3.0.6, =0.0.9, =1.61.0, =1.66.4 Source cves: CVE-2026-113717 Source advisory:...

baotool (1.0.1), farcaster-py (>=0.0.2, <=0.0.4) +6 more potentially affected by CVE-2026-113717 via virtualenv (20.24.5)

virtualenv PYPI version 20.24.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - baotool 1.0.1 - farcaster-py =0.0.2, =2.0.0, =0.103.0, =0.1.0, =1.0.0, =1.3.1 - zoish 4.6.0 Source cves: CVE-2026-113717 Source advisory:...

chemscad (2.0.3), pcapprocessor (0.1.0) +3 more potentially affected by CVE-2026-113714 via virtualenv (20.8.1)

virtualenv PYPI version 20.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chemscad 2.0.3 - pcapprocessor 0.1.0 - pickley =3.0.6, =0.0.9, =1.61.0, =1.66.4 Source cves: CVE-2026-113714 Source advisory:...

pkg-15903 (>=0.1.10, <=0.1.18), py-package-updater (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2026-113714 via virtualenv (20.29.3)

virtualenv PYPI version 20.29.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pkg-15903 =0.1.10, =0.1.1, =0.1.1, =1.0.9 - ten8t 0.0.22 - tidyfiles 0.6.3 Source cves: CVE-2026-113714 Source advisory:...

agentics-py (>=0.0.7, <=0.3.6), agentis (>=1.2.6, <=1.2.7) +202 more potentially affected by CVE-2026-113714 via virtualenv (>=21.1.0, <=21.14.5)

virtualenv PYPI version =21.1.0, =0.0.7, =1.2.6, =0.1.68, =0.1.0, =0.1.0, =0.5.0b2, =1.1.0a20250429, =0.0.3, =0.0.1a0, =0.1.1b20230324, =1.0.1b20240405, =1.0.1b20240405, =1.0.21, =0.2.40, =0.2.70 and more Source cves: CVE-2026-113714 Source advisory: GHSA-494P-63J8-28P3...

baotool (1.0.1), farcaster-py (>=0.0.2, <=0.0.4) +6 more potentially affected by CVE-2026-113714 via virtualenv (20.24.5)

virtualenv PYPI version 20.24.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - baotool 1.0.1 - farcaster-py =0.0.2, =2.0.0, =0.103.0, =0.1.0, =1.0.0, =1.3.1 - zoish 4.6.0 Source cves: CVE-2026-113714 Source advisory:...

cashu (0.15.1), cfg-analysis-tool-py (0.1.0) +7 more potentially affected by CVE-2026-113714 via virtualenv (20.25.0)

virtualenv PYPI version 20.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cashu 0.15.1 - cfg-analysis-tool-py 0.1.0 - edx-repo-tools 0.8.3 - mamba-toolbox =1.2.5.22, =0.2.1, =2.0.2, =0.1.15, =0.0.7, =0.0.8 Source...

agentics-py (>=0.0.7, <=0.3.6), agentis (>=1.2.6, <=1.2.7) +202 more potentially affected by CVE-2026-113714 via virtualenv (>=21.1.0, <=21.14.5)

virtualenv PYPI version =21.1.0, =0.0.7, =1.2.6, =0.1.68, =0.1.0, =0.1.0, =0.5.0b2, =1.1.0a20250429, =0.0.3, =0.0.1a0, =0.1.1b20230324, =1.0.1b20240405, =1.0.1b20240405, =1.0.21, =0.2.40, =0.2.70 and more Source cves: CVE-2026-113714 Source advisory: OSV:GHSA-494P-63J8-28P3...

chemscad (2.0.3), pcapprocessor (0.1.0) +3 more potentially affected by CVE-2026-113718 via virtualenv (20.8.1)

virtualenv PYPI version 20.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chemscad 2.0.3 - pcapprocessor 0.1.0 - pickley =3.0.6, =0.0.9, =1.61.0, =1.66.4 Source cves: CVE-2026-113718 Source advisory:...

cashu (0.15.1), cfg-analysis-tool-py (0.1.0) +7 more potentially affected by CVE-2026-113718 via virtualenv (20.25.0)

virtualenv PYPI version 20.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cashu 0.15.1 - cfg-analysis-tool-py 0.1.0 - edx-repo-tools 0.8.3 - mamba-toolbox =1.2.5.22, =0.2.1, =2.0.2, =0.1.15, =0.0.7, =0.0.8 Source...

pkg-15903 (>=0.1.10, <=0.1.18), py-package-updater (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2026-113718 via virtualenv (20.29.3)

virtualenv PYPI version 20.29.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pkg-15903 =0.1.10, =0.1.1, =0.1.1, =1.0.9 - ten8t 0.0.22 - tidyfiles 0.6.3 Source cves: CVE-2026-113718 Source advisory:...