EUVD-2026-78891
GHSA-5x67-j5xg-c5gj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.
AnalysisAI
Ingestion denial of service in Bugsink affects self-hosted instances running versions 2.2.1 and earlier, where any caller holding a valid project DSN can submit an event carrying an unusually large custom tag set and force the server to write excessive tag rows. Because Bugsink digests events through a single-writer database transaction, that oversized write blocks concurrent ingestion and temporarily starves the event pipeline of other projects and clients. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts th
Authenticated arbitrary file write in Bugsink 2.1.0 allows remote attackers to write malicious content to filesystem loc
Cross-project sourcemap and debug-file disclosure in Bugsink prior to 2.2.0 allows an authenticated user with access to
Cross-project issue state modification in Bugsink prior to 2.2.0 allows authenticated users with access to one project t
Cross-project event data exposure in Bugsink prior to 2.2.0 allows an authenticated user with access to one project to r
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allShare
External POC / Exploit Code
Leaving vuln.today