Sentry CVE-2026-52794

Exploitation requires the ability to submit events into Sentry's ingestion pipeline (typically possession of a valid project DSN, which is often publicly exposed in client-side code) and that the deployment runs an affected version 24.4.0-26.5.1 where the vulnerable hostname-parameterization regex executes during grouping. The malicious input must be placed in an attacker-controlled event field that flows through the grouping/parameterization stage, and must be shaped to maximize regex backtracking (long sequences of dot-separated alphanumeric segments that do not resolve to a valid TLD). Limiting factors: it is availability-only (no data access or code execution, C:N/I:N), it depends on the target processing externally-submitted events through the affected code path, and environments that strictly control DSN distribution or enforce worker CPU/time limits substantially reduce practical exploitability despite the CVSS PR:N rating.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) is internally consistent with a network-reachable, low-complexity, availability-only ReDoS, and aligns with the description and the diff. No EPSS score, no SSVC decision, and no POC or KEV signal were provided: exploitation status is therefore 'no public exploit identified at time of analysis,' and there is no evidence of active exploitation - do not treat this as a zero-day. The real-world priority is moderate-to-elevated rather than critical: impact is confined to availability (no data exposure or code execution), but the trigger sits in mandatory ingestion-path processing, so a single malicious event can disproportionately consume shared worker CPU and create a multi-tenant or queue-wide slowdown. One nuance to verify: CVSS marks PR:N, yet submitting events to Sentry requires a project DSN/key; in practice DSNs are frequently embedded in public client code, so PR:N is defensible, but environments that tightly restrict DSN exposure face a higher practical barrier than the raw vector implies.

An attacker who knows or harvests a project's Sentry DSN sends a crafted error event whose message or module-like field contains a long run of dot-separated alphanumeric segments engineered to nearly match the hostname pattern but fail at the TLD check. When the grouping pipeline applies the vulnerable regex, it backtracks heavily and pins a worker's CPU; repeating this across many events stalls event processing for the project or shared workers. No exploit code is publicly identified, but the disclosed regex and patch make the trigger straightforward to reconstruct.