CVE-2026-52794

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52794", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-08T18:02:19.731Z", "datePublished": "2026-06-24T21:26:26.512Z", "dateUpdated": "2026-06-25T13:52:33.945Z"}, "containers": {"cna": {"title": "Sentry: Inefficient Regular Expression Complexity in sentry", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856"}, {"name": "https://github.com/getsentry/sentry/pull/116587", "tags": ["x_refsource_MISC"], "url": "https://github.com/getsentry/sentry/pull/116587"}], "affected": [{"vendor": "getsentry", "product": "sentry", "versions": [{"version": ">= 24.4.0, < 26.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T21:26:26.512Z"}, "descriptions": [{"lang": "en", "value": "Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2."}], "source": {"advisory": "GHSA-jjqr-wqg2-p856", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T13:52:13.069327Z", "id": "CVE-2026-52794", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T13:52:33.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52794", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T13:52:13.069327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T13:52:20.241Z"}}], "cna": {"title": "Sentry: Inefficient Regular Expression Complexity in sentry", "source": {"advisory": "GHSA-jjqr-wqg2-p856", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "getsentry", "product": "sentry", "versions": [{"status": "affected", "version": ">= 24.4.0, < 26.5.2"}]}], "references": [{"url": "https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856", "name": "https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getsentry/sentry/pull/116587", "name": "https://github.com/getsentry/sentry/pull/116587", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T21:26:26.512Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52794", "state": "PUBLISHED", "dateUpdated": "2026-06-25T13:52:33.945Z", "dateReserved": "2026-06-08T18:02:19.731Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-24T21:26:26.512Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sentry", "vendor": "getsentry", "versions": [{"status": "affected", "version": ">= 24.4.0, < 26.5.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C832F35-0BFC-461C-9FC7-7573B1C97C43", "versionEndExcluding": "26.5.2", "versionStartIncluding": "24.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2."}, {"lang": "es", "value": "Sentry es una herramienta de seguimiento de errores y monitoreo de rendimiento. Desde la versi\u00f3n 24.4.0 hasta la 26.5.2, existe una vulnerabilidad de denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS) en el pipeline de ingesta de eventos de Sentry, donde una expresi\u00f3n regular aplicada a campos controlados por el atacante en eventos entrantes puede hacerse que consuma un tiempo de CPU desproporcionado. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 26.5.2."}], "id": "CVE-2026-52794", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52794", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T13:52:13.069327Z", "version": "2.0.3"}}]}, "published": "2026-06-24T22:16:47.647", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/getsentry/sentry/pull/116587"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[24.4.0,26.5.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "sentry", "source": "cna", "vendor": "getsentry"}, "product": "sentry", "vendor": "getsentry"}], "created": "2026-06-24T22:30:15.383930+00:00", "updated": "2026-06-25T05:45:02.759677+00:00", "vendors": ["getsentry", "getsentry$PRODUCT$sentry"]}