Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default
    query-string obfuscation regular expression can exhibit excessive backtracking while synchronously
    processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause
    prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing
    integrations that include query strings in URL span tags. The vulnerable processing is enabled by default
    for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6. (CVE-2026-116588)

ID	Name	Product	Family	Type	Severity
477752	Chainguard: datadog-agent-fips-7.84-core-integrations: security update to 7.84.6-r2	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
477752	Chainguard: datadog-agent-fips-7.84-core-integrations: security update to 7.84.6-r2	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
477600	SCA: security update for ddtrace (GHSA-3633-r77q-h3v3)	Tenable Cloud Security	SCA Checks	Local	high
477600	SCA: security update for ddtrace (GHSA-3633-r77q-h3v3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-116588

high

Tenable Plugins

high

high

high

high