Executive brief
Bugsink, an error-tracking and log aggregation tool, is vulnerable to a denial-of-service attack during data ingestion. An attacker can submit an event containing an excessive number of custom tags, which overwhelms the system's single-writer database architecture. This results in a temporary service outage where the platform is unable to process legitimate incoming error reports from other sources.
Technical details
Bugsink suffers from an uncontrolled resource consumption vulnerability (CWE-400) in its event ingestion component. The application uses a single-writer database architecture, meaning a single expensive write transaction can block all other ingestion tasks. An attacker with a valid project DSN (which is often accessible in client-side code) can submit an event with an arbitrarily large number of custom tags. This causes the database to spend excessive time writing tag rows, effectively stalling the ingestion of all other events. The issue is resolved in version 2.2.2 by implementing a configurable cap (MAX_EVENT_TAGS) on the number of tags stored per event.
Affected products
- Bugsink Bugsink <= 2.2.1
Timeline
- 2026-06-04: patched: Version 2.2.2 released
- 2026-06-05: advisory: GitHub Advisory published