CVE-2026-116693
Description
A flaw was found in dd-trace. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted HTTP request with a malicious URL query string. The default regular expression used to obfuscate query string metadata performs excessive backtracking during evaluation, consuming high CPU resources and rendering the instrumented application unavailable.
Statement
This vulnerability is rated as Important because a remote, unauthenticated attacker can exploit catastrophic regular expression backtracking to exhaust CPU resources, blocking the single-threaded Node.js event loop and causing a complete denial of service for the target service. The issue stems from synchronous evaluation of query string obfuscation rules triggered automatically on incoming HTTP requests when tracing is enabled. Red Hat Enterprise Linux and OpenShift do not ship dd-trace by default, but customer applications built on Red Hat runtimes and instrumented with this client library are susceptible without explicit configuration changes.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
