ddtrace
Datadog Python APM Client
View on Github
Activity
- Latest release
- 2d ago
- Total releases
- 861
- Cadence
- ~daily
- Last 12 months
- 174
Reach
- Stars
- 654
Details
- License
- unknown
- First release
- Jan 23, 2017
| Version | Released | |
|---|---|---|
4.16.1
patch
| ||
4.15.7
patch
| ||
4.16.0
minor
| ||
4.16.0rc2
pre
| ||
3.19.9
patch
2 CVEs
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-50271
PYSEC-2026-3461
GHSA-mw54-j2v2-42hr
Jul 23, 2026
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed. PatchesThis is resolved in version 4.8.2 and later of the WorkaroundsIf users cannot upgrade immediately:
ResourcesRelated upstream advisories: opentelemetry-go GHSA-mh2q-q3fh-2475 opentelemetry-dotnet GHSA-g94r-2vxg-569j Affected versions
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.12.1
0.13.0
0.13.1
0.14.0
0.14.1
0.15.0
0.16.0
+ 762 more Show less
0.17.0
0.17.1
0.18.0
0.19.0
0.20.0
0.20.1
0.20.2
0.20.3
0.20.4
0.21.0
0.21.1
0.22.0
0.23.0
0.24.0
0.25.0
0.26.0
0.27.0
0.27.1
0.28.0
0.29.0
0.30.0
0.30.1
0.30.2
0.31.0
0.32.0
0.32.1
0.32.2
0.33.0
0.34.0
0.34.1
0.34.2
0.35.0
0.35.1
0.35.2
0.36.0
0.36.1
0.36.2
0.36.3
0.37.0
0.37.1
0.37.2
0.37.3
0.38.0
0.38.1
0.38.2
0.38.3
0.38.4
0.39.0
0.39.1
0.39.2
0.40.0
0.40.1
0.40.2
0.41.0
0.41.1
0.41.2
0.42.0
0.43.0
0.43.1
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.48.1
0.48.2
0.48.3
0.48.4
0.49.0
0.49.0rc1
0.49.0rc2
0.49.1
0.49.2
0.49.3
0.49.4
0.5.3
0.5.4
0.5.5
0.50.0
0.50.0rc1
0.50.0rc2
0.50.0rc3
0.50.0rc4
0.50.0rc5
0.50.0rc6
0.50.0rc7
0.50.1
0.50.2
0.50.3
0.50.4
0.51.0
0.51.0rc1
0.51.0rc2
0.51.0rc3
0.51.0rc4
0.51.1
0.51.2
0.51.3
0.52.0
0.52.0rc1
0.52.0rc3
0.52.1
0.52.2
0.53.0
0.53.0rc1
0.53.0rc2
0.53.1
0.53.2
0.53.3
0.54.0
0.54.0rc1
0.54.1
0.55.0
0.55.0rc1
0.55.0rc2
0.55.1
0.55.2
0.55.3
0.55.4
0.56.0
0.56.0rc1
0.56.0rc2
0.56.0rc3
0.56.0rc4
0.56.0rc5
0.56.0rc6
0.56.0rc7
0.56.1
0.57.0
0.57.0rc1
0.57.0rc2
0.57.0rc3
0.57.1
0.57.2
0.57.3
0.57.4
0.58.0
0.58.0rc1
0.58.1
0.58.2
0.58.3
0.58.4
0.58.5
0.59.0
0.59.0rc1
0.59.0rc2
0.59.0rc3
0.59.1
0.59.2
0.6.0
0.60.0
0.60.0rc1
0.60.0rc2
0.60.0rc3
0.60.0rc4
0.60.0rc5
0.60.1
0.60.2
0.60.3
0.60.4
0.60.5
0.60.6
0.61.0
0.61.0rc1
0.61.0rc2
0.61.1
0.61.2
0.61.3
0.61.4
0.61.5
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.9.0
0.9.1
0.9.2
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.0.1
1.0.2
1.0.3
1.1.0
1.1.0rc1
1.1.0rc2
1.1.0rc3
1.1.1
1.1.2
1.1.3
1.1.4
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.2.0
1.2.0rc1
1.2.0rc2
1.2.0rc3
1.2.1
1.2.1rc1
1.2.2
1.2.3
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.3.0
1.3.0rc1
1.3.0rc2
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.4.0
1.4.0rc1
1.4.0rc2
1.4.0rc3
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0
1.5.0rc1
1.5.0rc2
1.5.0rc3
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
Fixed in
4.8.2
References Updated Jul 23, 2026 · Source: OSV.dev | ||
4.16.0rc1
pre
| ||
4.15.6
patch
| ||
4.15.5
patch
1 CVE
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.15.4
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.15.3
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.13.3
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.15.2
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.14.2
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.15.1
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.15.0
minor
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.15.0rc2
pre
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.14.1
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.11.8
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.15.0rc1
pre
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.13.2
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.14.0
minor
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.11.7
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.14.0rc4
pre
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.14.0rc3
pre
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.14.0rc2
pre
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.10.12
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.12.3
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.11.6
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.13.1
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.14.0rc1
pre
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.13.0
minor
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.11.5
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.9.7
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.10.11
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.12.2
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.13.0rc3
pre
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.11.4
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.12.1
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.13.0rc2
pre
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.11.3
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.13.0rc1
pre
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.10.10
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.11.2
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.12.0
minor
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.11.1
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.8.13
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.9.6
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
4.10.9
patch
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
3.19.8
patch
3 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-50271
PYSEC-2026-3461
GHSA-mw54-j2v2-42hr
Jul 23, 2026
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed. PatchesThis is resolved in version 4.8.2 and later of the WorkaroundsIf users cannot upgrade immediately:
ResourcesRelated upstream advisories: opentelemetry-go GHSA-mh2q-q3fh-2475 opentelemetry-dotnet GHSA-g94r-2vxg-569j Affected versions
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.12.1
0.13.0
0.13.1
0.14.0
0.14.1
0.15.0
0.16.0
+ 762 more Show less
0.17.0
0.17.1
0.18.0
0.19.0
0.20.0
0.20.1
0.20.2
0.20.3
0.20.4
0.21.0
0.21.1
0.22.0
0.23.0
0.24.0
0.25.0
0.26.0
0.27.0
0.27.1
0.28.0
0.29.0
0.30.0
0.30.1
0.30.2
0.31.0
0.32.0
0.32.1
0.32.2
0.33.0
0.34.0
0.34.1
0.34.2
0.35.0
0.35.1
0.35.2
0.36.0
0.36.1
0.36.2
0.36.3
0.37.0
0.37.1
0.37.2
0.37.3
0.38.0
0.38.1
0.38.2
0.38.3
0.38.4
0.39.0
0.39.1
0.39.2
0.40.0
0.40.1
0.40.2
0.41.0
0.41.1
0.41.2
0.42.0
0.43.0
0.43.1
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.48.1
0.48.2
0.48.3
0.48.4
0.49.0
0.49.0rc1
0.49.0rc2
0.49.1
0.49.2
0.49.3
0.49.4
0.5.3
0.5.4
0.5.5
0.50.0
0.50.0rc1
0.50.0rc2
0.50.0rc3
0.50.0rc4
0.50.0rc5
0.50.0rc6
0.50.0rc7
0.50.1
0.50.2
0.50.3
0.50.4
0.51.0
0.51.0rc1
0.51.0rc2
0.51.0rc3
0.51.0rc4
0.51.1
0.51.2
0.51.3
0.52.0
0.52.0rc1
0.52.0rc3
0.52.1
0.52.2
0.53.0
0.53.0rc1
0.53.0rc2
0.53.1
0.53.2
0.53.3
0.54.0
0.54.0rc1
0.54.1
0.55.0
0.55.0rc1
0.55.0rc2
0.55.1
0.55.2
0.55.3
0.55.4
0.56.0
0.56.0rc1
0.56.0rc2
0.56.0rc3
0.56.0rc4
0.56.0rc5
0.56.0rc6
0.56.0rc7
0.56.1
0.57.0
0.57.0rc1
0.57.0rc2
0.57.0rc3
0.57.1
0.57.2
0.57.3
0.57.4
0.58.0
0.58.0rc1
0.58.1
0.58.2
0.58.3
0.58.4
0.58.5
0.59.0
0.59.0rc1
0.59.0rc2
0.59.0rc3
0.59.1
0.59.2
0.6.0
0.60.0
0.60.0rc1
0.60.0rc2
0.60.0rc3
0.60.0rc4
0.60.0rc5
0.60.1
0.60.2
0.60.3
0.60.4
0.60.5
0.60.6
0.61.0
0.61.0rc1
0.61.0rc2
0.61.1
0.61.2
0.61.3
0.61.4
0.61.5
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.9.0
0.9.1
0.9.2
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.0.1
1.0.2
1.0.3
1.1.0
1.1.0rc1
1.1.0rc2
1.1.0rc3
1.1.1
1.1.2
1.1.3
1.1.4
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.2.0
1.2.0rc1
1.2.0rc2
1.2.0rc3
1.2.1
1.2.1rc1
1.2.2
1.2.3
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.3.0
1.3.0rc1
1.3.0rc2
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.4.0
1.4.0rc1
1.4.0rc2
1.4.0rc3
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0
1.5.0rc1
1.5.0rc2
1.5.0rc3
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
Fixed in
4.8.2
References Updated Jul 23, 2026 · Source: OSV.dev | ||
4.11.0
minor
2 CVEs
CVE-2026-116588
GHSA-3633-r77q-h3v3
Oct 27, 2026
Datadog dd-trace-py: ReDoS in URL query string obfuscation
High
Network
Low
None
None
SummaryA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. DetailsThe default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set both DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and DD_TRACE_OBFUSCATION_QUERY_STRING_PATTERN to the fixed Python-compatible regex below, then restart the application. Setting both variables covers all affected ddtrace versions, including releases before 1.19.0. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior. ImpactRegular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags. Affected versions
1.10.0
1.10.0rc1
1.10.0rc2
1.10.0rc3
1.10.1
1.10.2
1.10.3
1.11.0
1.11.0rc1
1.11.1
1.11.2
1.11.3
+ 601 more Show less
1.11.4
1.11.5
1.11.6
1.12.0
1.12.0rc1
1.12.1
1.12.10
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0rc1
1.13.0rc2
1.13.0rc3
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.0rc1
1.14.0rc2
1.14.1
1.14.2
1.14.3
1.15.0
1.15.0rc1
1.15.1
1.15.2
1.16.0
1.16.0rc1
1.16.0rc2
1.16.1
1.16.2
1.16.3
1.16.4
1.17.0
1.17.0rc1
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.18.0
1.18.0rc1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0rc1
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0
1.20.0rc1
1.20.1
1.20.10
1.20.11
1.20.12
1.20.13
1.20.14
1.20.15
1.20.16
1.20.17
1.20.18
1.20.19
1.20.2
1.20.3
1.20.4
1.20.5
1.20.6
1.20.7
1.20.8
1.20.9
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.0rc1
1.6.0rc2
1.6.0rc3
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.0rc1
1.7.0rc2
1.7.0rc3
1.7.0rc4
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.8.0rc1
1.8.0rc2
1.8.0rc3
1.8.0rc4
1.8.1
1.8.2
1.8.3
1.9.0
1.9.0rc2
1.9.0rc3
1.9.0rc4
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
2.0.0
2.0.0rc2
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.0rc1
2.1.0rc2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.0rc1
2.10.0rc2
2.10.0rc3
2.10.0rc4
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.11.0rc1
2.11.0rc2
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.12.0
2.12.0rc1
2.12.0rc2
2.12.1
2.12.2
2.12.3
2.12.4
2.13.0
2.13.0rc1
2.13.1
2.13.2
2.13.3
2.14.0
2.14.0rc1
2.14.1
2.14.2
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.15.0rc1
2.15.0rc2
2.15.0rc3
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0
2.16.0rc1
2.16.0rc2
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.17.0
2.17.0rc1
2.17.0rc2
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.18.0
2.18.0rc1
2.18.1
2.18.2
2.19.0
2.19.0rc1
2.19.0rc2
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.0rc1
2.2.1
2.2.2
2.2.3
2.20.0
2.20.0rc1
2.20.1
2.20.2
2.21.0
2.21.0rc1
2.21.1
2.21.10
2.21.11
2.21.12
2.21.2
2.21.3
2.21.4
2.21.5
2.21.5rc1
2.21.6
2.21.7
2.21.8
2.21.9
2.3.0
2.3.0rc1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0rc1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0rc1
2.5.0rc2
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.0rc1
2.7.1
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.0rc1
2.8.0rc2
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.9.0rc1
2.9.0rc2
2.9.0rc3
2.9.0rc4
2.9.0rc5
2.9.0rc6
2.9.0rc7
2.9.0rc8
2.9.0rc9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.1.0
3.1.0rc1
3.1.1
3.10.0
3.10.0rc1
3.10.0rc2
3.10.0rc3
3.10.1
3.10.2
3.10.3
3.10.4
3.11.0
3.11.0rc1
3.11.0rc2
3.11.0rc3
3.11.1
3.11.2
3.11.3
3.11.4
3.12.0
3.12.0rc1
3.12.0rc2
3.12.0rc3
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.13.0
3.13.0rc1
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.2.0
3.2.0rc1
3.2.1
3.2.1rc1
3.2.1rc2
3.2.2
3.2.3
3.3.0
3.3.0rc3
3.3.1
3.3.2
3.3.3
3.4.0
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.6.0
3.6.0rc1
3.7.0
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.8.0
3.8.0rc1
3.8.0rc2
3.8.0rc3
3.8.1
3.9.0
3.9.0rc1
3.9.0rc2
3.9.1
3.9.2
3.9.3
3.9.4
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.15.5
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
3.19.9
4.15.6
References
Updated Oct 27, 2026 · Source: OSV.dev
CVE-2026-116589
GHSA-p3m5-h5v9-vqj6
Oct 27, 2026
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
High
Network
Low
None
None
SummaryA flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. DetailsThe affected IAST string-processing instrumentation does not properly handle certain internal errors, allowing an error to terminate the application process. Exploitation requires IAST to be enabled and application code to perform an affected string-processing operation on attacker-controlled input. If you are unable to upgrade to a patched version of dd-trace-py, you can mitigate this issue by either disabling IAST (setting DD_IAST_ENABLED=false) or by replacing replace % string interpolations with str.format or f-strings for user inputs in your monitored application. Proof of conceptDetailed triggering inputs and reproduction steps are omitted from this advisory. The linked fix (#20786) includes regression coverage for the affected behavior. ImpactDenial of service affecting applications that use a vulnerable version of dd-trace-py with IAST enabled and expose the affected operation to attacker-controlled input. Successful exploitation terminates the affected Python process and interrupts the work it is handling. Affected versions
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.0rc1
3.14.0rc2
3.14.1
3.14.2
3.14.3
3.14.4
+ 181 more Show less
3.15.0
3.15.0rc1
3.15.1
3.16.0
3.16.0rc1
3.16.0rc2
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.17.0rc1
3.17.1
3.17.2
3.17.3
3.18.0
3.18.0rc1
3.18.0rc2
3.18.1
3.19.0
3.19.0rc1
3.19.1
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9
4.0.0
4.0.0rc1
4.0.0rc2
4.0.0rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0rc2
4.1.0rc3
4.1.1
4.1.2
4.1.3
4.1.4
4.10.0
4.10.0rc1
4.10.1
4.10.10
4.10.11
4.10.12
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0rc1
4.11.0rc2
4.11.0rc3
4.11.0rc4
4.11.0rc5
4.11.0rc6
4.11.0rc7
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.12.0
4.12.0rc1
4.12.0rc2
4.12.1
4.12.2
4.12.3
4.13.0
4.13.0rc1
4.13.0rc2
4.13.0rc3
4.13.1
4.13.2
4.13.3
4.14.0
4.14.0rc1
4.14.0rc2
4.14.0rc3
4.14.0rc4
4.14.1
4.14.2
4.15.0
4.15.0rc1
4.15.0rc2
4.15.1
4.15.2
4.15.3
4.15.4
4.2.0
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.1
4.2.2
4.2.3
4.3.0
4.3.0rc1
4.3.1
4.3.2
4.4.0
4.4.0rc1
4.4.0rc2
4.4.0rc3
4.5.0
4.5.0rc1
4.5.0rc2
4.5.0rc3
4.5.0rc4
4.5.1
4.5.10
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0rc1
4.6.0rc2
4.6.0rc3
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.0rc1
4.7.0rc2
4.7.0rc3
4.7.0rc4
4.7.0rc5
4.7.1
4.7.2
4.8.0
4.8.0rc1
4.8.0rc2
4.8.0rc3
4.8.0rc4
4.8.0rc5
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.9.0rc1
4.9.0rc2
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
Fixed in
4.15.5
References
Updated Oct 27, 2026 · Source: OSV.dev |