Executive brief
Sentry is an error tracking and performance monitoring platform used by developers to monitor application health. A vulnerability in how Sentry processes incoming data allows an attacker to send specially crafted events that overwhelm the system's processors. This can lead to a denial-of-service condition, slowing down or stopping the processing of legitimate error reports for all users on the affected instance.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability (CWE-1333) exists in Sentry's event ingestion pipeline within the hostname regex used for message parameterization and grouping. The root cause is an inefficient regular expression in `src/sentry/grouping/parameterization.py` that exhibits catastrophic backtracking when processing certain malformed hostname strings. An unauthenticated remote attacker can exploit this by sending a burst of malicious events containing crafted fields to a public DSN. This consumes disproportionate CPU time on event-processing worker pools, degrading ingestion throughput for the entire instance. The issue is fixed in version 26.5.2 by implementing length restrictions and moving TLD validation to an O(1) set lookup.
Affected products
- getsentry Sentry >= 24.4.0, < 26.5.2
Timeline
- 2026-06-01: patched: Fix merged into master branch
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD