CVE-2026-47716

Bugsink before version 2.2.2 stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because of the single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service.

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced.

Bugsink before 2.2.0 has a vulnerability where issue event pages accept a direct event identifier from the URL without verifying it belongs to the issue. A user with access to one project can view another project's event data. Fixed in 2.2.0.

Bugsink, a self-hosted error tracking tool, prior to version 2.1.3 has a vulnerability in webhook URL validation. A mismatch in URL parsing between Python and the requests library allows bypassing validation, so a URL may appear to target an allowed public host while the HTTP request actually goes to a different server.