CVE-2026-116693 DataDog CVE debrief

Who should care

Defenders responsible for applications using dd-trace with HTTP tracing integrations should assess exposure and prioritize updates to fixed versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions and exposure in their environments.

Why it matters

Defenders should care about CVE-2026-116693 because it can cause denial of service in applications using affected HTTP tracing integrations in dd-trace, and they should prioritize updates to fixed versions.

• Denial of service due to excessive CPU consumption
• Potential stall in request processing
• Need for verification of affected versions and exposure
• Priority for updating to fixed versions

Technical summary

The default query-string obfuscation pattern in dd-trace can exhibit excessive backtracking, allowing query-string processing to occupy application resources for an extended period. This can cause denial of service in applications using affected HTTP tracing integrations. The vulnerability is due to the synchronous application of the obfuscation pattern when recording HTTP URL metadata. Defenders should prioritize updating to fixed versions of dd-trace and assess exposure in their environments without making unsupported claims.

Defensive priority

Defenders should prioritize updating to fixed versions of dd-trace, specifically v5.131.1 or v6.20.1, and assess exposure in their environments.

Recommended defensive actions

• Update to dd-trace version 5.131.1 or 6.20.1
• Apply the workaround by setting DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP to the fixed regex
• Assess exposure in environments using affected HTTP tracing integrations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides details on the vulnerable regular expression and workarounds, but does not provide information on exploitation or specific victims. The dd-trace package's default query-string obfuscation pattern can cause excessive CPU consumption, leading to denial of service. Defenders should verify affected versions and exposure in their environments. The source item from osv_dev provides additional context on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.