EUVD-2026-39103Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable ingestion with low-complexity crafted input and no real auth barrier (public DSNs) gives AV:N/AC:L/PR:N; ReDoS yields availability-only impact (A:H, C/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.
AnalysisAI
Denial of service in Sentry's self-hosted/SaaS event ingestion pipeline (versions 24.4.0 through 26.5.1) lets remote actors who can submit events stall worker CPU via a Regular Expression Denial of Service (ReDoS). A loosely-written hostname-detection regex in the grouping parameterization stage (parameterization.py) backtracks catastrophically on crafted attacker-controlled event fields, exhausting CPU and degrading or halting event processing. No public exploit identified at time of analysis and it is not in CISA KEV, but the fix (26.5.2) and the triggering regex are publicly disclosed in the GitHub advisory and PR #116587, lowering the bar to reproduce.
Technical ContextAI
Sentry normalizes incoming events to group similar errors, and part of that grouping replaces identifiable tokens (IPs, hostnames, etc.) with placeholders so unrelated events fingerprint together. The vulnerable code is src/sentry/grouping/parameterization.py, which used a regex to find hostname-like substrings before swapping them for a <hostname> token. The original pattern combined a nested, optionally-quantified segment group (([a-zA-Z0-9\-]{1,63}\.)+?) with a large TLD alternation, a classic recipe for CWE-1333 (Inefficient Regular Expression Complexity): ambiguous overlapping repetition lets a single input be matched many ways, so a non-matching tail forces exponential/polynomial backtracking. Because grouping runs on attacker-influenced event content (e.g., error messages, stack/module strings), a crafted string of dot-separated segments that nearly-but-never satisfies the TLD requirement maximizes backtracking. The fix replaces the greedy structure with a bounded {1,127} segment count, per-segment lookaheads/anchors that remove ambiguity, and moves TLD validation out of the regex into an is_valid_hostname callback plus length caps (255 chars, 63-char segments).
RemediationAI
Vendor-released patch: upgrade to Sentry 26.5.2 or later, which rewrites the hostname regex with bounded repetition and shifts TLD/length validation into the is_valid_hostname callback (see PR https://github.com/getsentry/sentry/pull/116587 and advisory https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856). For self-hosted operators who cannot immediately upgrade, the practical compensating controls are: place per-event CPU/time limits or timeouts on the ingestion/grouping workers so a single event cannot monopolize a worker (trade-off: such events get dropped or marked errored); rate-limit and cap incoming event field sizes at the relay/proxy layer to shrink the input space that reaches the regex (trade-off: very large legitimate payloads may be truncated); and restrict which clients can submit events by tightening DSN distribution and network access to the ingestion endpoints (trade-off: operational overhead and possible loss of telemetry from locked-out clients). Because the impact is availability only, scaling/isolating worker pools also limits blast radius but does not remove the underlying ReDoS.
Remote code execution in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows unauthenticated remote attackers to a
Authentication bypass in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to c
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary co
Sentry is an error tracking and performance monitoring platform. Rated high severity (CVSS 8.1), this vulnerability is r
Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauth
Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parame
An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Rated medium severity (CVSS 5.3
SAML authentication bypass in Sentry 21.12.0 through 26.1.0.
Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute
An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today