CVE-2026-116588

A flaw was found in dd-trace-py. The default regular expression used for query-string obfuscation can encounter excessive backtracking when processing input for HTTP tracing metadata. A remote attacker can exploit this vulnerability by submitting specially crafted URL query strings, resulting in...

CVE-2026-116588

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

EUVD-2026-110469

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...