{"id":"CVE-2026-52794","aliases":["EUVD-2026-39103","GHSA-jjqr-wqg2-p856"],"status":"published","title":"Sentry: Inefficient Regular Expression Complexity in sentry","description":"Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00545,"percentile":0.46213,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1333"],"published":"2026-06-24T21:26:26Z","modified":"2026-10-28T02:30:55Z","products":[{"vendor":"getsentry","product":"sentry"},{"vendor":"sentry","product":"sentry"}],"references":[{"url":"https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory"]},{"url":"https://github.com/getsentry/sentry/pull/116587","tags":["x_refsource_MISC","Issue Tracking","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52794.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52794","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-52794","title":"Sentry: Inefficient Regular Expression Complexity in sentry","description":"Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.","status":"published","published":"2026-06-24T21:26:26.512Z","modified":"2026-06-25T13:52:33.945Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-39103","description":"Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.","status":"published","published":"2026-06-24T21:26:26Z","modified":"2026-06-25T13:52:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:29.213001Z"}],"nvd":[{"id":"CVE-2026-52794","description":"Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.","status":"published","published":"2026-06-24T22:16:47.647Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:25.67873Z"}],"osv":[{"id":"CVE-2026-52794","title":"Sentry: Inefficient Regular Expression Complexity in sentry","description":"Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.","status":"published","published":"2026-06-24T21:26:26.512Z","modified":"2026-10-28T02:30:55.182660473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:45:07.431113Z"}]}}