CVE-2026-53954Medium· 4.3▾ SunlitBugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force exce…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
bugsink < 2.2.2Patched in:
bugsink 2.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47715Low· 3.1Bugsink: Issue event views can show an event from another project if its UUID is known
CVE-2026-47716Low· 3.1Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
CVE-2026-44502Medium· 4.3Bunsink has an SSRF bypass in `validate_webhook_url`
CVE-2026-40162High· 7.1Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
CVE-2026-47728Medium· 4.3Bugsink: Project scoping missing in sourcemap and debug-file lookup
CVE-2025-64509High· 7.5Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)