PT-2026-127226
CVE-2026-116693
·
Published
2026-10-27
·
Updated
2026-10-27
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
dd-trace versions 2.0.0 through 5.131.0
dd-trace versions 6.0.0 through 6.20.0
Description
A regular expression used to obfuscate URL query strings can cause excessive backtracking when processing specific attacker-controlled input. This occurs synchronously while recording HTTP URL metadata, which can lead to excessive CPU consumption, stalled request processing, and a denial of service (ReDoS), making the instrumented application unavailable. The issue is triggered via the
DD TRACE OBFUSCATION QUERY STRING REGEXP variable.Recommendations
Update dd-trace to version 5.131.1.
Update dd-trace to version 6.20.1.
As a temporary workaround, set the
DD TRACE OBFUSCATION QUERY STRING REGEXP variable to the fixed regular expression provided in the official advisory and restart the application. Found an issue in the description? Have something to add? Feel free to write us 👾