4.3

CVE-2026-53954

Bugsink: DOS using large numbers of event tags

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerbugsink
≫
Produkt bugsink
Version < 2.2.2
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

https://github.com/bugsink/bugsink/security/advisories/GHSA-5x67-j5xg-c5gj
https://github.com/bugsink/bugsink/commit/1d0539fefcd1a796143d15d84053b1c0122ef8c7
https://github.com/bugsink/bugsink/commit/8dca571b9e66c535ed4885465db820824e7c491a
https://github.com/bugsink/bugsink/releases/tag/2.2.2