dd-trace Vulnerability: ReDOS in URL Query String Obfuscation (CVE-2026-116693)

Executive Summary

A vulnerability in the dd-trace library, identified as CVE-2026-116693, can cause a denial of service (DoS) due to excessive CPU consumption when processing certain attacker-controlled URL query strings. This affects applications using affected HTTP tracing integrations. The vulnerability has a CVSS score of 8.7.

Technical Analysis

The vulnerability is caused by a regular expression used to obfuscate URL query strings, which can exhibit excessive backtracking when processing certain attacker-controlled input. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. This is a Regular Expression Denial of Service (ReDoS) vulnerability.

How It Gets Exploited

An attacker can exploit this vulnerability by sending a crafted URL query string to an application using the vulnerable dd-trace library. The query string would be designed to trigger excessive backtracking in the regular expression, causing the application to consume excessive CPU resources and potentially leading to a denial of service. For example, an attacker might send a request with a query string that includes a long, complex sequence of characters designed to cause the regular expression to backtrack excessively.

Impact Assessment

The vulnerability affects applications that use the dd-trace library, specifically versions >= 2.0.0, < 5.131.1 and >= 6.0.0, < 6.20.1. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability. The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags.

Recommended Actions

To mitigate this vulnerability, update the dd-trace library to version 5.131.1 or later, or version 6.20.1 or later. As a workaround, set the DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP environment variable to a fixed regex pattern, then restart the application. The fixed regex pattern is: DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP='(?:(?":"|%22)?)(?:(?:old[-_]?|new[-_]?)?p(?:ass)?w(?:or)?d(?:1|2)?|pass(?:[-_]?phrase)?|secret|(?:api[-_]?|private[-_]?|public[-_]?|access[-_]?|secret[-_]?|app(?:lication)?[-_]?)key(?:[-_]?id)?|token|consumer[-_]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\s|%20)*(?:=|%3D)[^&]+|(?:"|%22)(?:\s|%20)*(?::|%3A)(?:\s|%20)*(?:"|%22)(?:%2[^2]|%[^2]|[^"%])+(?:"|%22))|(?:bearer(?:\s|%20)+[a-z0-9._\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|(?:(?

Sources

• GitHub Security Advisories