---
id: CVE-2026-53954
title: Bugsink is a self-hosted error tracking tool
summary: >-
  Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink
  stores every set of custom tags supplied with an incoming event, allowing a
  caller with a valid project DSN to submit an unusually large tag set and force
  exce…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-400
vendor: bugsink
product: bugsink
affected:
  - bugsink < 2.2.2
patched:
  - bugsink 2.2.2
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T20:17:19.293'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53954'
references:
  - url: >-
      https://github.com/bugsink/bugsink/commit/1d0539fefcd1a796143d15d84053b1c0122ef8c7
    label: security-advisories@github.com
  - url: >-
      https://github.com/bugsink/bugsink/commit/8dca571b9e66c535ed4885465db820824e7c491a
    label: security-advisories@github.com
  - url: 'https://github.com/bugsink/bugsink/releases/tag/2.2.2'
    label: security-advisories@github.com
  - url: 'https://github.com/bugsink/bugsink/security/advisories/GHSA-5x67-j5xg-c5gj'
    label: security-advisories@github.com
  - url: 'https://github.com/bugsink/bugsink'
tags:
  - nvd
  - cve.org
  - osv
  - pip
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T18:57:37.866602Z'
aliases:
  - GHSA-5x67-j5xg-c5gj
  - PYSEC-2026-2403
ecosystem: pip
ingestedAt: '2026-07-13T18:57:53.509Z'
epss: 0.0056
epssPercentile: 0.44288
---

## Overview

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53954)

Affected packages:

- `bugsink < 2.2.2`

Patched in:

- `bugsink 2.2.2`

Source: https://osv.dev/vulnerability/GHSA-5x67-j5xg-c5gj