Datadog dd-trace-py CVE-2026-116588

Exploitation requires that the application use an affected dd-trace-py HTTP tracing integration that records query strings in URL span tags, with the default query-string obfuscation regular expression in effect - the vendor states this vulnerable processing is enabled by default for those integrations, so no non-default configuration is needed to be at risk. The attacker must be able to supply the URL query string of inbound HTTP requests (attacker-controlled input), which is the normal case for internet-facing endpoints. Limiting factors: only impacts deployments running vulnerable versions (>=1.5.0,<3.19.9 or >=4.0.0,<4.15.6) with HTTP integrations that tag query strings; impact is availability only (no data exposure); and the issue can be neutralized without upgrading by setting both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the vendor-provided fixed regex and restarting the application, though the vendor's complete fix is upgrading to 3.19.9 or 4.15.6.

This is a genuine availability-focused issue but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack with no authentication or user interaction, and impact is confined to availability (VA:H; VC:N/VI:N) - consistent with a ReDoS (CWE-1333) that burns CPU rather than exposing or altering data. The signals are internally consistent but modest: EPSS is low at 0.47% (40th percentile), there is no CISA KEV listing, and no public exploit code has been published - the GHSA advisory explicitly withholds triggering inputs and reproduction steps. The vuln.today decision label is 'this_week', aligning with a patch-promptly posture rather than act_now/emergency. The CVSS base score of 8.7 looks high, but that is driven by the easy remote reachability of a pure DoS; there is no confidentiality or integrity exposure. Net: treat as a real, patch-this-week priority for anyone running affected dd-trace-py versions with default query-string obfuscation, but not a confirmed-exploited or data-breach-class risk. The low EPSS combined with a withheld PoC suggests exploitation is plausible but not yet widespread or automated.

An attacker sends HTTP requests to a web application instrumented with an affected dd-trace-py HTTP integration, placing a crafted query string that triggers catastrophic backtracking in the default obfuscation regular expression. Because the pattern is applied synchronously while recording the URL span tag, a few such requests tie up application CPU, inflating request latency and eventually causing service unavailability. No public, verified exploit code exists - the advisory omits the triggering inputs - but the attack requires no authentication and no user interaction.