CVE-2026-52794

Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/getsentry/sentry/pull/116587	Issue Tracking Patch
https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Sentry es una herramienta de seguimiento de errores y monitoreo de rendimiento. Desde la versión 24.4.0 hasta la 26.5.2, existe una vulnerabilidad de denegación de servicio por expresión regular (ReDoS) en el pipeline de ingesta de eventos de Sentry, donde una expresión regular aplicada a campos controlados por el atacante en eventos entrantes puede hacerse que consuma un tiempo de CPU desproporcionado. Esta vulnerabilidad está corregida en la versión 26.5.2.

Information

Published : 2026-06-24 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-52794

Mitre link : CVE-2026-52794

CVE.ORG link : CVE-2026-52794

JSON object : View

Products Affected

sentry

sentry

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-52794", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52794", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T13:52:13.069327Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getsentry", "product": "sentry", "versions": [{"status": "affected", "version": ">= 24.4.0, < 26.5.2"}]}]}], "published": "2026-06-24T22:16:47.647", "references": [{"url": "https://github.com/getsentry/sentry/pull/116587", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2."}, {"lang": "es", "value": "Sentry es una herramienta de seguimiento de errores y monitoreo de rendimiento. Desde la versi\u00f3n 24.4.0 hasta la 26.5.2, existe una vulnerabilidad de denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS) en el pipeline de ingesta de eventos de Sentry, donde una expresi\u00f3n regular aplicada a campos controlados por el atacante en eventos entrantes puede hacerse que consuma un tiempo de CPU desproporcionado. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 26.5.2."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C832F35-0BFC-461C-9FC7-7573B1C97C43", "versionEndExcluding": "26.5.2", "versionStartIncluding": "24.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}