Skip to content

Inefficient Regular Expression Complexity in Sentry

High
oioki published GHSA-jjqr-wqg2-p856 Jun 3, 2026

Package

pip sentry (pip)

Affected versions

>= 24.4.0, < 26.5.2

Patched versions

26.5.2

Description

Impact

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time.

Who is affected:

  • SaaS (sentry.io): already fixed and deployed. No action required from SaaS users.
  • Self-hosted: a small burst of malicious events can degrade ingestion throughput on the shared event-processing worker pool, affecting unrelated projects on the same instance.

Patches

#116587

Workarounds

We strongly encourage to upgrade to the latest available version. If this is not possible, operators of self-hosted instances may apply the following mitigations:

  • Tighten per-DSN ingest rate limits on projects whose DSNs are publicly exposed. These are configured under Project Settings → Client Keys (DSN) → Rate Limits. General self-hosted operations guidance is available at https://develop.sentry.dev/self-hosted/.
  • Monitor for sustained high CPU on taskworker processes and on the events-consumer.

References

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE ID

CVE-2026-52794

Weaknesses

Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Learn more on MITRE.

Credits