CVE-2026-52794

{
  "id": "CVE-2026-52794",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T22:16:47.647",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2."
    },
    {
      "lang": "es",
      "value": "Sentry es una herramienta de seguimiento de errores y monitoreo de rendimiento. Desde la versión 24.4.0 hasta la 26.5.2, existe una vulnerabilidad de denegación de servicio por expresión regular (ReDoS) en el pipeline de ingesta de eventos de Sentry, donde una expresión regular aplicada a campos controlados por el atacante en eventos entrantes puede hacerse que consuma un tiempo de CPU desproporcionado. Esta vulnerabilidad está corregida en la versión 26.5.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "getsentry",
          "product": "sentry",
          "versions": [
            {
              "version": ">= 24.4.0, < 26.5.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T13:52:13.069327Z",
          "id": "CVE-2026-52794",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "24.4.0",
              "versionEndExcluding": "26.5.2",
              "matchCriteriaId": "7C832F35-0BFC-461C-9FC7-7573B1C97C43"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/getsentry/sentry/pull/116587",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}