dd-trace: ReDOS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

GHSA-X94G-W73Q-HPCW dd-trace: ReDOS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

CVE-2026-116693 dd-trace: ReDOS in URL query string obfuscation

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a...

CVE-2026-116693

The dd-trace Datadog APM client for Node.js is vulnerable to a Regular Expression Denial of Service (ReDoS) in the URL query string obfuscation logic. Specifically, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking when processing attacker-controlled URL quer...

Datadog dd-trace-py: ReDoS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

GHSA-3633-R77Q-H3V3 Datadog dd-trace-py: ReDoS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

CVE-2026-116588 Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

CVE-2026-116588

The Datadog dd-trace-py Python APM client (versions 1.5.0 through 3.19.9 and 4.15.6) is vulnerable to a Regular Expression Denial of Service (ReDOS) . The flaw exists in the default query-string obfuscation regular expression, which can undergo excessive backtracking when synchronously processing...

CVE-2026-116588 Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

PT-2026-125468

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

DEBIAN-CVE-2026-114460

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

CVE-2026-114460

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

EUVD-2026-108024

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

CVE-2026-114460

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

CLSA-2026-1772646645 butane: Fix of 2 CVEs

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE - CVE-2025-61729: limit parsed URL query parameters to mitigate excessive memory consumption during form parsing...

ApostropheCMS: Cross-domain session token in URL confers session takeover

Summary Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session including passport.user with no credentials. Details...

PT-2026-118508

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions 3.x and 4.0.0 through 4.32.2 Description A client-side prototype pollution issue exists in the apos.http.parseQuery function. The parser fails to sanitize the proto , constructor, and prototype keys when processing URL...

CVE-2026-88785

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

CVE-2026-88785 Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

EUVD-2026-96773

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...