# CVE-2026-116588: Datadog dd-trace-py: ReDOS in URL query string obfuscation

Status: published. Published: 2026-10-26. Updated: 2026-11-02.

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

## Remediation

- fix: ddtrace (PyPI): OSV reports a fixed version 3.19.9. Check the advisory for supported release branches. (source: OSV GHSA-3633-r77q-h3v3) — https://github.com/advisories/GHSA-3633-r77q-h3v3
- fix: ddtrace (PyPI): OSV reports a fixed version 4.15.6. Check the advisory for supported release branches. (source: OSV GHSA-3633-r77q-h3v3) — https://github.com/advisories/GHSA-3633-r77q-h3v3

## Affected products and versions

- DataDog / dd-trace-py: >= 1.5.0, < 3.19.9 (affected); >= 4.0.0, < 4.15.6 (affected). Source: CNA: GitHub_M
-  / ddtrace (ddtrace): 1.10.0 (affected, PyPI); 1.10.0rc1 (affected, PyPI); 1.10.0rc2 (affected, PyPI); 1.10.0rc3 (affected, PyPI); 1.10.1 (affected, PyPI); 1.10.2 (affected, PyPI); 1.10.3 (affected, PyPI); 1.11.0 (affected, PyPI); 1.11.0rc1 (affected, PyPI); 1.11.1 (affected, PyPI); 1.11.2 (affected, PyPI); 1.11.3 (affected, PyPI); 1.11.4 (affected, PyPI); 1.11.5 (affected, PyPI); 1.11.6 (affected, PyPI); 1.12.0 (affected, PyPI); 1.12.0rc1 (affected, PyPI); 1.12.1 (affected, PyPI); 1.12.10 (affected, PyPI); 1.12.2 (affected, PyPI); 1.12.3 (affected, PyPI); 1.12.4 (affected, PyPI); 1.12.5 (affected, PyPI); 1.12.6 (affected, PyPI); 1.12.7 (affected, PyPI); 1.12.8 (affected, PyPI); 1.12.9 (affected, PyPI); 1.13.0 (affected, PyPI); 1.13.0rc1 (affected, PyPI); 1.13.0rc2 (affected, PyPI); 1.13.0rc3 (affected, PyPI); 1.13.1 (affected, PyPI); 1.13.2 (affected, PyPI); 1.13.3 (affected, PyPI); 1.13.4 (affected, PyPI); 1.13.5 (affected, PyPI); 1.13.6 (affected, PyPI); 1.14.0 (affected, PyPI); 1.14.0rc1 (affected, PyPI); 1.14.0rc2 (affected, PyPI); 1.14.1 (affected, PyPI); 1.14.2 (affected, PyPI); 1.14.3 (affected, PyPI); 1.15.0 (affected, PyPI); 1.15.0rc1 (affected, PyPI); 1.15.1 (affected, PyPI); 1.15.2 (affected, PyPI); 1.16.0 (affected, PyPI); 1.16.0rc1 (affected, PyPI); 1.16.0rc2 (affected, PyPI); 1.16.1 (affected, PyPI); 1.16.2 (affected, PyPI); 1.16.3 (affected, PyPI); 1.16.4 (affected, PyPI); 1.17.0 (affected, PyPI); 1.17.0rc1 (affected, PyPI); 1.17.1 (affected, PyPI); 1.17.2 (affected, PyPI); 1.17.3 (affected, PyPI); 1.17.4 (affected, PyPI); 1.17.5 (affected, PyPI); 1.17.6 (affected, PyPI); 1.18.0 (affected, PyPI); 1.18.0rc1 (affected, PyPI); 1.18.1 (affected, PyPI); 1.18.2 (affected, PyPI); 1.18.3 (affected, PyPI); 1.18.4 (affected, PyPI); 1.18.5 (affected, PyPI); 1.18.6 (affected, PyPI); 1.18.7 (affected, PyPI); 1.18.8 (affected, PyPI); 1.19.0 (affected, PyPI); 1.19.0rc1 (affected, PyPI); 1.19.1 (affected, PyPI); 1.19.2 (affected, PyPI); 1.19.3 (affected, PyPI); 1.19.4 (affected, PyPI); 1.19.5 (affected, PyPI); 1.19.6 (affected, PyPI); 1.19.7 (affected, PyPI); 1.20.0 (affected, PyPI); 1.20.0rc1 (affected, PyPI); 1.20.1 (affected, PyPI); 1.20.10 (affected, PyPI); 1.20.11 (affected, PyPI); 1.20.12 (affected, PyPI); 1.20.13 (affected, PyPI); 1.20.14 (affected, PyPI); 1.20.15 (affected, PyPI); 1.20.16 (affected, PyPI); 1.20.17 (affected, PyPI); 1.20.18 (affected, PyPI); 1.20.19 (affected, PyPI); 1.20.2 (affected, PyPI); 1.20.3 (affected, PyPI); 1.20.4 (affected, PyPI); 1.20.5 (affected, PyPI); 1.20.6 (affected, PyPI); 1.20.7 (affected, PyPI); 1.20.8 (affected, PyPI); 1.20.9 (affected, PyPI); 1.5.0 (affected, PyPI); 1.5.1 (affected, PyPI); 1.5.2 (affected, PyPI); 1.5.3 (affected, PyPI); 1.5.4 (affected, PyPI); 1.5.5 (affected, PyPI); 1.6.0 (affected, PyPI); 1.6.0rc1 (affected, PyPI); 1.6.0rc2 (affected, PyPI); 1.6.0rc3 (affected, PyPI); 1.6.1 (affected, PyPI); 1.6.2 (affected, PyPI); 1.6.3 (affected, PyPI); 1.6.4 (affected, PyPI); 1.6.5 (affected, PyPI); 1.6.6 (affected, PyPI); 1.7.0 (affected, PyPI); 1.7.0rc1 (affected, PyPI); 1.7.0rc2 (affected, PyPI); 1.7.0rc3 (affected, PyPI); 1.7.0rc4 (affected, PyPI); 1.7.1 (affected, PyPI); 1.7.2 (affected, PyPI); 1.7.3 (affected, PyPI); 1.7.4 (affected, PyPI); 1.7.5 (affected, PyPI); 1.8.0 (affected, PyPI); 1.8.0rc1 (affected, PyPI); 1.8.0rc2 (affected, PyPI); 1.8.0rc3 (affected, PyPI); 1.8.0rc4 (affected, PyPI); 1.8.1 (affected, PyPI); 1.8.2 (affected, PyPI); 1.8.3 (affected, PyPI); 1.9.0 (affected, PyPI); 1.9.0rc2 (affected, PyPI); 1.9.0rc3 (affected, PyPI); 1.9.0rc4 (affected, PyPI); 1.9.1 (affected, PyPI); 1.9.2 (affected, PyPI); 1.9.3 (affected, PyPI); 1.9.4 (affected, PyPI); 1.9.5 (affected, PyPI); 1.9.6 (affected, PyPI); 1.9.7 (affected, PyPI); 2.0.0 (affected, PyPI); 2.0.0rc2 (affected, PyPI); 2.0.1 (affected, PyPI); 2.0.10 (affected, PyPI); 2.0.2 (affected, PyPI); 2.0.3 (affected, PyPI); 2.0.4 (affected, PyPI); 2.0.5 (affected, PyPI); 2.0.6 (affected, PyPI); 2.0.7 (affected, PyPI); 2.0.8 (affected, PyPI); 2.0.9 (affected, PyPI); 2.1.0 (affected, PyPI); 2.1.0rc1 (affected, PyPI); 2.1.0rc2 (affected, PyPI); 2.1.1 (affected, PyPI); 2.1.2 (affected, PyPI); 2.1.3 (affected, PyPI); 2.1.4 (affected, PyPI); 2.1.5 (affected, PyPI); 2.1.6 (affected, PyPI); 2.1.7 (affected, PyPI); 2.1.8 (affected, PyPI); 2.1.9 (affected, PyPI); 2.10.0 (affected, PyPI); 2.10.0rc1 (affected, PyPI); 2.10.0rc2 (affected, PyPI); 2.10.0rc3 (affected, PyPI); 2.10.0rc4 (affected, PyPI); 2.10.1 (affected, PyPI); 2.10.2 (affected, PyPI); 2.10.3 (affected, PyPI); 2.10.4 (affected, PyPI); 2.10.5 (affected, PyPI); 2.10.6 (affected, PyPI); 2.10.7 (affected, PyPI); 2.11.0 (affected, PyPI); 2.11.0rc1 (affected, PyPI); 2.11.0rc2 (affected, PyPI); 2.11.1 (affected, PyPI); 2.11.2 (affected, PyPI); 2.11.3 (affected, PyPI); 2.11.4 (affected, PyPI); 2.11.5 (affected, PyPI); 2.11.6 (affected, PyPI); 2.11.7 (affected, PyPI); 2.11.8 (affected, PyPI); 2.12.0 (affected, PyPI); 2.12.0rc1 (affected, PyPI); 2.12.0rc2 (affected, PyPI); 2.12.1 (affected, PyPI); 2.12.2 (affected, PyPI); 2.12.3 (affected, PyPI); 2.12.4 (affected, PyPI); 2.13.0 (affected, PyPI); 2.13.0rc1 (affected, PyPI); 2.13.1 (affected, PyPI); 2.13.2 (affected, PyPI); 2.13.3 (affected, PyPI); 2.14.0 (affected, PyPI); 2.14.0rc1 (affected, PyPI); 2.14.1 (affected, PyPI); 2.14.2 (affected, PyPI); 2.14.4 (affected, PyPI); 2.14.5 (affected, PyPI); 2.14.6 (affected, PyPI); 2.14.7 (affected, PyPI); 2.15.0 (affected, PyPI); 2.15.0rc1 (affected, PyPI); 2.15.0rc2 (affected, PyPI); 2.15.0rc3 (affected, PyPI); 2.15.1 (affected, PyPI); 2.15.2 (affected, PyPI); 2.15.3 (affected, PyPI); 2.15.4 (affected, PyPI); 2.16.0 (affected, PyPI); 2.16.0rc1 (affected, PyPI); 2.16.0rc2 (affected, PyPI); 2.16.1 (affected, PyPI); 2.16.2 (affected, PyPI); 2.16.3 (affected, PyPI); 2.16.4 (affected, PyPI); 2.16.5 (affected, PyPI); 2.16.6 (affected, PyPI); 2.17.0 (affected, PyPI); 2.17.0rc1 (affected, PyPI); 2.17.0rc2 (affected, PyPI); 2.17.1 (affected, PyPI); 2.17.2 (affected, PyPI); 2.17.3 (affected, PyPI); 2.17.4 (affected, PyPI); 2.17.5 (affected, PyPI); 2.18.0 (affected, PyPI); 2.18.0rc1 (affected, PyPI); 2.18.1 (affected, PyPI); 2.18.2 (affected, PyPI); 2.19.0 (affected, PyPI); 2.19.0rc1 (affected, PyPI); 2.19.0rc2 (affected, PyPI); 2.19.1 (affected, PyPI); 2.19.2 (affected, PyPI); 2.19.3 (affected, PyPI); 2.19.4 (affected, PyPI); 2.2.0 (affected, PyPI); 2.2.0rc1 (affected, PyPI); 2.2.1 (affected, PyPI); 2.2.2 (affected, PyPI); 2.2.3 (affected, PyPI); 2.20.0 (affected, PyPI); 2.20.0rc1 (affected, PyPI); 2.20.1 (affected, PyPI); 2.20.2 (affected, PyPI); 2.21.0 (affected, PyPI); 2.21.0rc1 (affected, PyPI); 2.21.1 (affected, PyPI); 2.21.10 (affected, PyPI); 2.21.11 (affected, PyPI); 2.21.12 (affected, PyPI); 2.21.2 (affected, PyPI); 2.21.3 (affected, PyPI); 2.21.4 (affected, PyPI); 2.21.5 (affected, PyPI); 2.21.5rc1 (affected, PyPI); 2.21.6 (affected, PyPI); 2.21.7 (affected, PyPI); 2.21.8 (affected, PyPI); 2.21.9 (affected, PyPI); 2.3.0 (affected, PyPI); 2.3.0rc1 (affected, PyPI); 2.3.1 (affected, PyPI); 2.3.2 (affected, PyPI); 2.3.3 (affected, PyPI); 2.3.4 (affected, PyPI); 2.3.5 (affected, PyPI); 2.4.0 (affected, PyPI); 2.4.0rc1 (affected, PyPI); 2.4.1 (affected, PyPI); 2.4.2 (affected, PyPI); 2.4.3 (affected, PyPI); 2.4.4 (affected, PyPI); 2.5.0 (affected, PyPI); 2.5.0rc1 (affected, PyPI); 2.5.0rc2 (affected, PyPI); 2.5.1 (affected, PyPI); 2.5.2 (affected, PyPI); 2.5.3 (affected, PyPI); 2.5.4 (affected, PyPI); 2.5.5 (affected, PyPI); 2.5.6 (affected, PyPI); 2.6.0 (affected, PyPI); 2.6.1 (affected, PyPI); 2.6.10 (affected, PyPI); 2.6.11 (affected, PyPI); 2.6.12 (affected, PyPI); 2.6.2 (affected, PyPI); 2.6.3 (affected, PyPI); 2.6.4 (affected, PyPI); 2.6.5 (affected, PyPI); 2.6.6 (affected, PyPI); 2.6.7 (affected, PyPI); 2.6.8 (affected, PyPI); 2.6.9 (affected, PyPI); 2.7.0 (affected, PyPI); 2.7.0rc1 (affected, PyPI); 2.7.1 (affected, PyPI); 2.7.10 (affected, PyPI); 2.7.2 (affected, PyPI); 2.7.3 (affected, PyPI); 2.7.4 (affected, PyPI); 2.7.5 (affected, PyPI); 2.7.6 (affected, PyPI); 2.7.7 (affected, PyPI); 2.7.8 (affected, PyPI); 2.7.9 (affected, PyPI); 2.8.0 (affected, PyPI); 2.8.0rc1 (affected, PyPI); 2.8.0rc2 (affected, PyPI); 2.8.1 (affected, PyPI); 2.8.2 (affected, PyPI); 2.8.3 (affected, PyPI); 2.8.4 (affected, PyPI); 2.8.5 (affected, PyPI); 2.8.6 (affected, PyPI); 2.8.7 (affected, PyPI); 2.9.0 (affected, PyPI); 2.9.0rc1 (affected, PyPI); 2.9.0rc2 (affected, PyPI); 2.9.0rc3 (affected, PyPI); 2.9.0rc4 (affected, PyPI); 2.9.0rc5 (affected, PyPI); 2.9.0rc6 (affected, PyPI); 2.9.0rc7 (affected, PyPI); 2.9.0rc8 (affected, PyPI); 2.9.0rc9 (affected, PyPI); 2.9.1 (affected, PyPI); 2.9.2 (affected, PyPI); 2.9.3 (affected, PyPI); 2.9.4 (affected, PyPI); 2.9.5 (affected, PyPI); 2.9.6 (affected, PyPI); 3.0.0 (affected, PyPI); 3.0.0rc1 (affected, PyPI); 3.0.0rc2 (affected, PyPI); 3.0.0rc3 (affected, PyPI); 3.1.0 (affected, PyPI); 3.1.0rc1 (affected, PyPI); 3.1.1 (affected, PyPI); 3.10.0 (affected, PyPI); 3.10.0rc1 (affected, PyPI); 3.10.0rc2 (affected, PyPI); 3.10.0rc3 (affected, PyPI); 3.10.1 (affected, PyPI); 3.10.2 (affected, PyPI); 3.10.3 (affected, PyPI); 3.10.4 (affected, PyPI); 3.11.0 (affected, PyPI); 3.11.0rc1 (affected, PyPI); 3.11.0rc2 (affected, PyPI); 3.11.0rc3 (affected, PyPI); 3.11.1 (affected, PyPI); 3.11.2 (affected, PyPI); 3.11.3 (affected, PyPI); 3.11.4 (affected, PyPI); 3.12.0 (affected, PyPI); 3.12.0rc1 (affected, PyPI); 3.12.0rc2 (affected, PyPI); 3.12.0rc3 (affected, PyPI); 3.12.1 (affected, PyPI); 3.12.2 (affected, PyPI); 3.12.3 (affected, PyPI); 3.12.4 (affected, PyPI); 3.12.5 (affected, PyPI); 3.12.6 (affected, PyPI); 3.12.7 (affected, PyPI); 3.12.8 (affected, PyPI); 3.12.9 (affected, PyPI); 3.13.0 (affected, PyPI); 3.13.0rc1 (affected, PyPI); 3.13.1 (affected, PyPI); 3.13.2 (affected, PyPI); 3.13.3 (affected, PyPI); 3.13.4 (affected, PyPI); 3.14.0 (affected, PyPI); 3.14.0rc1 (affected, PyPI); 3.14.0rc2 (affected, PyPI); 3.14.1 (affected, PyPI); 3.14.2 (affected, PyPI); 3.14.3 (affected, PyPI); 3.14.4 (affected, PyPI); 3.15.0 (affected, PyPI); 3.15.0rc1 (affected, PyPI); 3.15.1 (affected, PyPI); 3.16.0 (affected, PyPI); 3.16.0rc1 (affected, PyPI); 3.16.0rc2 (affected, PyPI); 3.16.1 (affected, PyPI); 3.16.2 (affected, PyPI); 3.16.3 (affected, PyPI); 3.16.4 (affected, PyPI); 3.17.0 (affected, PyPI); 3.17.0rc1 (affected, PyPI); 3.17.1 (affected, PyPI); 3.17.2 (affected, PyPI); 3.17.3 (affected, PyPI); 3.18.0 (affected, PyPI); 3.18.0rc1 (affected, PyPI); 3.18.0rc2 (affected, PyPI); 3.18.1 (affected, PyPI); 3.19.0 (affected, PyPI); 3.19.0rc1 (affected, PyPI); 3.19.1 (affected, PyPI); 3.19.2 (affected, PyPI); 3.19.3 (affected, PyPI); 3.19.4 (affected, PyPI); 3.19.5 (affected, PyPI); 3.19.6 (affected, PyPI); 3.19.7 (affected, PyPI); 3.19.8 (affected, PyPI); 3.2.0 (affected, PyPI); 3.2.0rc1 (affected, PyPI); 3.2.1 (affected, PyPI); 3.2.1rc1 (affected, PyPI); 3.2.1rc2 (affected, PyPI); 3.2.2 (affected, PyPI); 3.2.3 (affected, PyPI); 3.3.0 (affected, PyPI); 3.3.0rc3 (affected, PyPI); 3.3.1 (affected, PyPI); 3.3.2 (affected, PyPI); 3.3.3 (affected, PyPI); 3.4.0 (affected, PyPI); 3.4.0rc1 (affected, PyPI); 3.4.0rc2 (affected, PyPI); 3.4.1 (affected, PyPI); 3.4.2 (affected, PyPI); 3.5.0 (affected, PyPI); 3.5.0rc1 (affected, PyPI); 3.5.1 (affected, PyPI); 3.6.0 (affected, PyPI); 3.6.0rc1 (affected, PyPI); 3.7.0 (affected, PyPI); 3.7.0rc1 (affected, PyPI); 3.7.0rc2 (affected, PyPI); 3.7.1 (affected, PyPI); 3.7.2 (affected, PyPI); 3.8.0 (affected, PyPI); 3.8.0rc1 (affected, PyPI); 3.8.0rc2 (affected, PyPI); 3.8.0rc3 (affected, PyPI); 3.8.1 (affected, PyPI); 3.9.0 (affected, PyPI); 3.9.0rc1 (affected, PyPI); 3.9.0rc2 (affected, PyPI); 3.9.1 (affected, PyPI); 3.9.2 (affected, PyPI); 3.9.3 (affected, PyPI); 3.9.4 (affected, PyPI); Ecosystem version events: introduced 1.5.0; fixed 3.19.9. Source: OSV GHSA-3633-r77q-h3v3
-  / ddtrace (ddtrace): 4.0.0 (affected, PyPI); 4.0.1 (affected, PyPI); 4.0.2 (affected, PyPI); 4.0.3 (affected, PyPI); 4.0.4 (affected, PyPI); 4.1.0 (affected, PyPI); 4.1.0rc2 (affected, PyPI); 4.1.0rc3 (affected, PyPI); 4.1.1 (affected, PyPI); 4.1.2 (affected, PyPI); 4.1.3 (affected, PyPI); 4.1.4 (affected, PyPI); 4.10.0 (affected, PyPI); 4.10.0rc1 (affected, PyPI); 4.10.1 (affected, PyPI); 4.10.10 (affected, PyPI); 4.10.11 (affected, PyPI); 4.10.12 (affected, PyPI); 4.10.2 (affected, PyPI); 4.10.3 (affected, PyPI); 4.10.4 (affected, PyPI); 4.10.5 (affected, PyPI); 4.10.6 (affected, PyPI); 4.10.7 (affected, PyPI); 4.10.8 (affected, PyPI); 4.10.9 (affected, PyPI); 4.11.0 (affected, PyPI); 4.11.0rc1 (affected, PyPI); 4.11.0rc2 (affected, PyPI); 4.11.0rc3 (affected, PyPI); 4.11.0rc4 (affected, PyPI); 4.11.0rc5 (affected, PyPI); 4.11.0rc6 (affected, PyPI); 4.11.0rc7 (affected, PyPI); 4.11.1 (affected, PyPI); 4.11.2 (affected, PyPI); 4.11.3 (affected, PyPI); 4.11.4 (affected, PyPI); 4.11.5 (affected, PyPI); 4.11.6 (affected, PyPI); 4.11.7 (affected, PyPI); 4.11.8 (affected, PyPI); 4.12.0 (affected, PyPI); 4.12.0rc1 (affected, PyPI); 4.12.0rc2 (affected, PyPI); 4.12.1 (affected, PyPI); 4.12.2 (affected, PyPI); 4.12.3 (affected, PyPI); 4.13.0 (affected, PyPI); 4.13.0rc1 (affected, PyPI); 4.13.0rc2 (affected, PyPI); 4.13.0rc3 (affected, PyPI); 4.13.1 (affected, PyPI); 4.13.2 (affected, PyPI); 4.13.3 (affected, PyPI); 4.14.0 (affected, PyPI); 4.14.0rc1 (affected, PyPI); 4.14.0rc2 (affected, PyPI); 4.14.0rc3 (affected, PyPI); 4.14.0rc4 (affected, PyPI); 4.14.1 (affected, PyPI); 4.14.2 (affected, PyPI); 4.15.0 (affected, PyPI); 4.15.0rc1 (affected, PyPI); 4.15.0rc2 (affected, PyPI); 4.15.1 (affected, PyPI); 4.15.2 (affected, PyPI); 4.15.3 (affected, PyPI); 4.15.4 (affected, PyPI); 4.15.5 (affected, PyPI); 4.2.0 (affected, PyPI); 4.2.0rc1 (affected, PyPI); 4.2.0rc2 (affected, PyPI); 4.2.0rc3 (affected, PyPI); 4.2.1 (affected, PyPI); 4.2.2 (affected, PyPI); 4.2.3 (affected, PyPI); 4.3.0 (affected, PyPI); 4.3.0rc1 (affected, PyPI); 4.3.1 (affected, PyPI); 4.3.2 (affected, PyPI); 4.4.0 (affected, PyPI); 4.4.0rc1 (affected, PyPI); 4.4.0rc2 (affected, PyPI); 4.4.0rc3 (affected, PyPI); 4.5.0 (affected, PyPI); 4.5.0rc1 (affected, PyPI); 4.5.0rc2 (affected, PyPI); 4.5.0rc3 (affected, PyPI); 4.5.0rc4 (affected, PyPI); 4.5.1 (affected, PyPI); 4.5.10 (affected, PyPI); 4.5.2 (affected, PyPI); 4.5.3 (affected, PyPI); 4.5.4 (affected, PyPI); 4.5.5 (affected, PyPI); 4.5.6 (affected, PyPI); 4.5.7 (affected, PyPI); 4.5.8 (affected, PyPI); 4.5.9 (affected, PyPI); 4.6.0 (affected, PyPI); 4.6.0rc1 (affected, PyPI); 4.6.0rc2 (affected, PyPI); 4.6.0rc3 (affected, PyPI); 4.6.1 (affected, PyPI); 4.6.2 (affected, PyPI); 4.6.3 (affected, PyPI); 4.6.4 (affected, PyPI); 4.6.5 (affected, PyPI); 4.6.6 (affected, PyPI); 4.6.7 (affected, PyPI); 4.6.8 (affected, PyPI); 4.7.0 (affected, PyPI); 4.7.0rc1 (affected, PyPI); 4.7.0rc2 (affected, PyPI); 4.7.0rc3 (affected, PyPI); 4.7.0rc4 (affected, PyPI); 4.7.0rc5 (affected, PyPI); 4.7.1 (affected, PyPI); 4.7.2 (affected, PyPI); 4.8.0 (affected, PyPI); 4.8.0rc1 (affected, PyPI); 4.8.0rc2 (affected, PyPI); 4.8.0rc3 (affected, PyPI); 4.8.0rc4 (affected, PyPI); 4.8.0rc5 (affected, PyPI); 4.8.1 (affected, PyPI); 4.8.10 (affected, PyPI); 4.8.11 (affected, PyPI); 4.8.12 (affected, PyPI); 4.8.13 (affected, PyPI); 4.8.2 (affected, PyPI); 4.8.3 (affected, PyPI); 4.8.4 (affected, PyPI); 4.8.5 (affected, PyPI); 4.8.6 (affected, PyPI); 4.8.7 (affected, PyPI); 4.8.8 (affected, PyPI); 4.8.9 (affected, PyPI); 4.9.0 (affected, PyPI); 4.9.0rc1 (affected, PyPI); 4.9.0rc2 (affected, PyPI); 4.9.1 (affected, PyPI); 4.9.2 (affected, PyPI); 4.9.3 (affected, PyPI); 4.9.4 (affected, PyPI); 4.9.5 (affected, PyPI); 4.9.6 (affected, PyPI); 4.9.7 (affected, PyPI); Ecosystem version events: introduced 4.0.0; fixed 4.15.6. Source: OSV GHSA-3633-r77q-h3v3

## Severity and prioritization

- CVSS 4.0: 8.7 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: 0.47% as of 2026-11-02; percentile 40.49%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-1333

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/DataDog/dd-trace-py/pull/20857 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/DataDog/dd-trace-py/pull/20862 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/DataDog/dd-trace-py/pull/20880 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/advisories/GHSA-3633-r77q-h3v3 (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-3633-r77q-h3v3 (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-116588; retrieved 2026-11-02; source updated 2026-11-02

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-3633-r77q-h3v3; retrieved 2026-11-02; source updated 2026-10-27

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-116588; retrieved 2026-11-02; source updated Not reported

Revision: 62267174847c8afe32c806d0ade434f6a999108250c7f4742e868a2e842eb1e2

Canonical: https://y2.dev/cve/CVE-2026-116588

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.