Denial of Service Vulnerability in Bugsink Error Tracking Tool

CVE-2026-53954

What is CVE-2026-53954?

Bugsink, a self-hosted error tracking tool, was vulnerable to a Denial of Service due to its handling of custom tags in incoming events. Versions prior to 2.2.2 allowed attackers with valid project DSNs to submit excessively large sets of tags. This malfunctioned the system by delaying the processing of other events due to the single-writer database architecture, which caused reduced availability for the affected instance. The vulnerability did not compromise stored data or allow for code execution. Version 2.2.2 has been released, implementing a MAX_EVENT_TAGS limit to mitigate this risk.

References