CVE-2026-116588Published
Datadog dd-trace-py: ReDOS in URL query string obfuscation
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-116588 · Microsoft / collected KEV context
cve-program · CVE-2026-116588
- https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3
- https://github.com/DataDog/dd-trace-py/pull/20857
- https://github.com/DataDog/dd-trace-py/pull/20862
- https://github.com/DataDog/dd-trace-py/pull/20880
- https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd
- https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce
- https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8
- https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9
- https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6
Related operational evidence
Explicit CVE identifiers- Datadog dd-trace-py: ReDOS in URL query string obfuscation · Newly collected advisory · 26 Oct 2026