ETK-2026-985Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-985",
  "cve_id": null,
  "display_id": "ETK-2026-985",
  "ghsa_id": "GHSA-vmc3-q32r-rv64",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Regular expression denial of service in dd-trace-go obfuscation",
  "summary": "Affected dd-trace-go HTTP tracing integrations process URL query strings with a default obfuscation expression that can use excessive CPU. An attacker able to supply query strings to traced requests may increase latency or make the application unavailable when query strings are included in URL span tags.",
  "mitigation": "Upgrade github.com/DataDog/dd-trace-go and github.com/DataDog/dd-trace-go/v2 to version 2.11.1 or later. Until upgrading, set DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP to the corrected expression provided by the advisory and restart the application.",
  "vendor": "go",
  "product": "go:github.com/DataDog/dd-trace-go",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 2.11.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "2.11.1"
      ],
      "package_name": "github.com/DataDog/dd-trace-go",
      "purl": "pkg:golang/github.com/DataDog/dd-trace-go"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 2.11.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "2.11.1"
      ],
      "package_name": "github.com/DataDog/dd-trace-go/v2",
      "purl": "pkg:golang/github.com/DataDog/dd-trace-go/v2"
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.9917493,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T15:01:40+00:00",
      "days": -13.355824361111111,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T23:34:03.248406+00:00",
      "url": "https://github.com/DataDog/dd-trace-go/security/advisories/GHSA-vmc3-q32r-rv64"
    }
  }
}