CVE-2026-52794: Sentry ReDoS Vulnerability in Event Ingestion (CVSS 7.5)

Technical summary

CVE-2026-52794 is a Regular Expression Denial of Service (ReDoS) vulnerability in Sentry's event ingestion pipeline. The vulnerability stems from a regex pattern applied to attacker-controlled input fields within incoming events. Maliciously crafted regex patterns can trigger catastrophic backtracking, causing the regex engine to spend disproportionate computational time on pattern matching. This occurs during event processing before persistence, meaning attackers need only send a single malformed event to trigger CPU exhaustion on the Sentry instance. The issue affects all versions from 24.4.0 up to and including 26.5.1, resolved in 26.5.2.

Business impact

A successful attack disrupts error tracking and performance monitoring capabilities across dependent applications. Organizations relying on Sentry for observability lose real-time visibility into application health, errors, and performance metrics during the attack window. If a Sentry instance is shared across multiple internal teams or used by multiple customer-facing products, a single ReDoS attack can degrade service for all consumers. For SaaS customers, this may also impact Sentry's availability guarantees and SLA compliance.

Affected systems

Sentry versions 24.4.0 through 26.5.1 are affected. This includes self-hosted Sentry deployments and Sentry Cloud instances running vulnerable versions. Any organization ingesting events into an unpatched Sentry instance is at risk. The vulnerability does not require authentication or special privileges; any external or internal entity capable of sending events to the Sentry ingestion endpoint can trigger it.

Exploitability

The attack surface is broad: any event sent to a Sentry ingestion endpoint can serve as the attack vector. No authentication is required (unless Sentry's auth settings are explicitly enforced). Crafting a malicious event requires minimal knowledge—an attacker need only understand the structure of event payloads and how to design a regex pattern that triggers backtracking in the regex engine used by Sentry. The attack is repeatable and can be launched remotely over the network. This is a low-complexity, high-impact denial-of-service vector.

Remediation

Organizations must upgrade Sentry to version 26.5.2 or later. For self-hosted deployments, this involves updating the Sentry application code and redeploying. For Sentry Cloud customers, upgrades are typically handled automatically, but customers should verify they are on a patched version. No workaround is available short of blocking event ingestion or implementing upstream request validation to reject suspicious payloads before they reach Sentry.

Patch guidance

Verify against the official Sentry security advisory and release notes that your deployment is running 26.5.2 or newer. Self-hosted users should consult the Sentry upgrade documentation for their deployment method (Docker, Kubernetes, bare metal, etc.). Sentry Cloud customers should confirm patch status through the Sentry dashboard or support channels. Test the upgrade in a non-production environment first, and schedule production upgrades during maintenance windows to minimize service disruption.

Detection guidance

Monitor Sentry server CPU usage for sudden spikes or sustained high utilization without corresponding legitimate event volume increases. Examine Sentry logs for regex processing timeouts or performance warnings in the event ingestion pipeline. Review incoming event payloads for unusual patterns or malformed fields that deviate from normal application error formats. Network-level monitoring can help identify sources sending unusually formatted or high-volume event streams to your Sentry endpoint. Consider implementing rate limiting on event ingestion if not already in place.

Why prioritize this

This vulnerability warrants prompt patching due to the high CVSS score (7.5), the low barrier to exploitation, and the direct impact on service availability. Unlike vulnerabilities requiring authentication or user interaction, this ReDoS flaw can be triggered by any external or internal attacker with network access to the Sentry ingestion endpoint. Organizations using Sentry for mission-critical observability should deprioritize other non-critical updates in favor of this patch to restore full resilience.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an unauthenticated, network-accessible denial-of-service vector with no user interaction required and low attack complexity. The attack vector is network-based (AV:N), access control is not a prerequisite (PR:N, UI:N), and the scope is unchanged (S:U). The impact is limited to availability (A:H), with no confidentiality or integrity compromise, which prevents a Critical rating. The score appropriately captures a high-severity operational risk that does not result in data breach or unauthorized access.

Frequently asked questions