CVE-2026-52794 Sentry: Inefficient Regular Expression Complexity in sentry
Attackers can cause excessive CPU consumption in Sentry's event ingestion pipeline via crafted input, leading to service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-52794?
CVE-2026-52794 is a high-severity denial of service vulnerability in getsentry sentry, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.
Weakness: CWE-1333
Which versions are affected by CVE-2026-52794?
It affects 1 product.
Products include Sentry Sentry.
How do I fix CVE-2026-52794?
No fix has been published for CVE-2026-52794 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-52794 being exploited?
There is no known exploitation of CVE-2026-52794 in the wild and no public exploit code.
Other vulnerabilities in getsentry sentry
- CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking
- CVE-2026-27197 Sentry: Improper Authentication on SAML SSO process allows user identity linking
- CVE-2021-47935 Sentry 8.2.0 Remote Code Execution via Pickle Deserialization
- CVE-2023-39349 Sentry vulnerable to privilege escalation via ApiTokensEndpoint
- CVE-2023-36826 Sentry vulnerable to improper authorization on debug and artifact file downloads
Sources
Also known as GHSA-jjqr-wqg2-p856.