Datadog dd-trace-py: ReDoS in query string obfuscation
Summary
Datadog dd-trace-py, the Python APM client, uses a regular expression to obfuscate query strings in HTTP URL span tags. Versions 1.5.0 up to 3.19.9 and 4.0.0 up to 4.15.6 can backtrack excessively on crafted query strings. A remote attacker can cause high CPU usage, request latency and service unavailability in affected HTTP tracing integrations. The vulnerable processing is enabled by default for these integrations, and no authentication is required. The CNA rates the issue CVSS 4.0 8.7 (High); NVD had not yet completed its analysis.
Affected
- dd-trace-py from 1.5.0 before 3.19.9
- dd-trace-py from 4.0.0 before 4.15.6
- Versions 2.x and older 1.x branches: Unknown.
Fixed in
- Upgrade to 3.19.9 or 4.15.6 (or later).
Workaround
- Unknown. No vendor-confirmed workaround was verified for this entry.
- Disabling query string tagging in the tracer would avoid the vulnerable processing, but may expose tokens or passwords from URLs in your APM data. Only do this if your data protection rules allow it.
Exploitation
- No known exploitation in the wild. The CVE is not listed in CISA KEV.
- No public proof of concept found at the time of research. The flaw is a regex issue, so a PoC could be built from the public advisory and commits.
Our recommendation
- Identify all ddtrace or dd-trace-py installations, including requirements files, lock files and container images.
- Upgrade to 3.19.9 or 4.15.6 or later, prioritising internet-facing Python services.
- If an upgrade must wait, apply a documented mitigation and check it against your data protection rules.
- Monitor web services for CPU spikes and latency increases after requests with long query strings.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3633-r77q-h3v3 github.com
- dd-trace-py release v3.19.9 github.com
- dd-trace-py release v4.15.6 github.com
- Fix commit for 3.x backport github.com
- Fix commit for 4.x backport github.com
- OSV entry GHSA-3633-r77q-h3v3 osv.dev
- GitLab advisory CVE-2026-116588 advisories.gitlab.com
- Tenable CVE-2026-116588 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:05.
Original description (NVD)
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.
NVD references (9)
- https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd
- https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce
- https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8
- https://github.com/DataDog/dd-trace-py/pull/20857
- https://github.com/DataDog/dd-trace-py/pull/20862
- https://github.com/DataDog/dd-trace-py/pull/20880
- https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9
- https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6
- https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.