CVE-2026-53954
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Bugsink before version 2.2.2 stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because of the single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service.
Risk Assessment
An attacker can cause temporary unavailability of event ingestion, affecting the availability of the error tracking system.
Recommendation
It is recommended to upgrade Bugsink to version 2.2.2 or later, which introduces the MAX_EVENT_TAGS limit before storage.
Other vulnerabilities in Bugsink
See all- CVE-2026-47728Medium
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced.
- CVE-2026-47716Low
Bugsink before 2.2.0 has a vulnerability where the issue list authorizes access via the project in the URL but applies bulk actions to submitted issue IDs without verifying they belong to that project. Fixed in 2.2.0.
- CVE-2026-47715Low
Bugsink before 2.2.0 has a vulnerability where issue event pages accept a direct event identifier from the URL without verifying it belongs to the issue. A user with access to one project can view another project's event data. Fixed in 2.2.0.
- CVE-2026-44502Medium
Bugsink, a self-hosted error tracking tool, prior to version 2.1.3 has a vulnerability in webhook URL validation. A mismatch in URL parsing between Python and the requests library allows bypassing validation, so a URL may appear to target an allowed public host while the HTTP request actually goes to a different server.
Original NVD description (English source)
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS