CVE-2026-116588: dd-trace-py: ReDoS in query-string obfuscation causes DoS

Datadog's Python APM client (dd-trace-py, 1.5.0 up to 3.19.9 and 4.15.6) uses a default regex to obfuscate URL query strings that can backtrack catastrophically, so a single crafted request can pin a CPU core and stall the service. Because the processing runs synchronously in the request path and is enabled by default in the HTTP tracing integrations, any internet-facing Python service instrumented with dd-trace-py, including AI inference APIs and LLM gateways built on FastAPI, Flask or Django, can be knocked offline by an unauthenticated attacker. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, and the blast radius (downstream dependents) is unknown, but ReDoS payloads are trivial to craft once the fix commits are public. Upgrade to 3.19.9 or 4.15.6 now; if you cannot, restrict query strings in span tags or customize the obfuscation regex, and alert on abnormal CPU and latency spikes on traced endpoints.

No confirmed active exploitation of CVE-2026-116588 has been reported, but organizations should still patch proactively.

1) Upgrade ddtrace to 3.19.9 (3.x line) or 4.15.6 (4.x line). 2) Inventory services with ddtrace installed (pip list, SBOM, container scans) and prioritize internet-facing ones. 3) Workaround if patching is delayed: disable inclusion of query strings in URL span tags or override the default query-string obfuscation regex with a safe pattern, and apply WAF or gateway limits on query string length. 4) Detection: alert on sustained 100% CPU in worker processes, spikes in p99 latency, and requests with unusually long or repetitive query strings in access logs. 5) Use worker timeouts and health-check based restarts to limit blast radius.

This vulnerability affects the following AI/ML architecture patterns: Model serving, LLM API gateways, RAG pipelines, Agent frameworks, MLOps services.

No CVSS score has been assigned yet.