CVE-2026-52794: Sentry ReDoS Denial of Service Vulnerability

CVE-2026-52794 Overview

CVE-2026-52794 is a Regular Expression Denial of Service (ReDoS) vulnerability in Sentry, an error tracking and performance monitoring tool. The flaw exists in Sentry's event ingestion pipeline, where a regular expression applied to attacker-controlled fields on incoming events can consume disproportionate CPU time. Affected versions range from 24.4.0 through versions prior to 26.5.2. The vulnerability is classified under CWE-1333, Inefficient Regular Expression Complexity. Sentry resolved the issue in version 26.5.2.

Critical Impact
Remote unauthenticated attackers can trigger CPU exhaustion by submitting crafted event payloads, degrading or disrupting Sentry's event ingestion service availability.

Affected Products

Sentry versions 24.4.0 through versions prior to 26.5.2
Self-hosted Sentry deployments running affected releases
Sentry event ingestion pipeline components processing attacker-controlled event fields

Discovery Timeline

2026-06-24 - CVE CVE-2026-52794 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52794

Vulnerability Analysis

The vulnerability resides in Sentry's event ingestion pipeline, where a regular expression is applied to fields within incoming events. Because event payloads are submitted by clients reporting errors and telemetry, the content of these fields is attacker-controllable. A specially crafted input can drive the regex engine into catastrophic backtracking, causing a single request to consume substantial CPU time. Repeated submission of such payloads exhausts processing capacity in the ingestion worker pool, blocking legitimate event processing. The flaw maps to CWE-1333, Inefficient Regular Expression Complexity.

Root Cause

The root cause is a regular expression pattern that exhibits non-linear runtime complexity when matched against adversarial input. Patterns containing nested quantifiers or overlapping alternations can backtrack exponentially, meaning processing time grows disproportionately with input length. Sentry applied this regex to event fields without bounding input size or constraining regex execution time, allowing arbitrary clients to inflict CPU exhaustion on the ingestion service.

Attack Vector

An attacker submits crafted event data to a Sentry ingestion endpoint over the network. No authentication or user interaction is required because Sentry ingestion endpoints accept events from clients identified by project DSNs, and the vulnerable field is processed before authorization decisions complete. Repeated or parallel submissions amplify the impact, tying up worker processes and starving legitimate event processing. The result is targeted availability degradation of the Sentry instance.

No verified public exploit code was available at the time of publication. See the GitHub Security Advisory GHSA-jjqr-wqg2-p856 and the upstream fix in pull request 116587 for technical details.

Detection Methods for CVE-2026-52794

Indicators of Compromise

Sustained high CPU utilization on Sentry ingestion workers without a corresponding increase in legitimate event volume
Growing backlog in event processing queues alongside elevated request latency on /api/*/store/ or /api/*/envelope/ endpoints
Repeated incoming events with unusually long or pathological string values in attacker-controllable fields

Detection Strategies

Inspect ingestion logs for clients sending events with abnormally large field sizes or repetitive character patterns that suggest ReDoS payloads
Correlate spikes in per-request processing time with the source IP address or project DSN to identify abusive senders
Compare deployed Sentry version against 26.5.2 to confirm whether the affected code path is present

Monitoring Recommendations

Track event ingestion latency, worker CPU consumption, and queue depth as continuous service health metrics
Alert when individual event processing exceeds an expected duration threshold, since normal regex matches complete in microseconds
Forward Sentry application and proxy logs to a centralized SIEM or data lake for rate-based and anomaly-based analysis

How to Mitigate CVE-2026-52794

Immediate Actions Required

Upgrade Sentry to version 26.5.2 or later, which contains the fix for the vulnerable regex pattern
Inventory all self-hosted Sentry deployments and confirm version 24.4.0 through pre-26.5.2 instances are prioritized for patching
Place rate limits and request size restrictions in front of Sentry ingestion endpoints until the upgrade is complete

Patch Information

Sentry released a fix in version 26.5.2. The remediation is documented in the GitHub Security Advisory GHSA-jjqr-wqg2-p856 and implemented in pull request 116587. Operators should apply the upstream release rather than attempting to backport the regex change manually.

Workarounds

Enforce strict maximum payload and field length limits at the reverse proxy or load balancer level to reduce ReDoS amplification
Apply per-DSN and per-IP rate limits on ingestion endpoints to constrain how quickly a single source can submit events
Isolate Sentry ingestion workers with CPU and memory cgroups so resource exhaustion does not impact co-located services

bash

# Example NGINX configuration to limit request body size and rate in front of Sentry ingestion
http {
    limit_req_zone $binary_remote_addr zone=sentry_ingest:10m rate=20r/s;

    server {
        listen 443 ssl;
        server_name sentry.example.com;

        client_max_body_size 1m;

        location ~ ^/api/.*/(store|envelope)/ {
            limit_req zone=sentry_ingest burst=40 nodelay;
            proxy_read_timeout 10s;
            proxy_pass http://sentry_backend;
        }
    }
}