CVE-2026-53954

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53954
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53954.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53954
Aliases
Published
2026-09-15T17:20:15Z
Modified
2026-09-17T03:47:27Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Bugsink: DOS using large numbers of event tags
Details

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53954.json"
}
References

Affected packages

Git / github.com/bugsink/bugsink

Affected ranges

Type
GIT
Repo
https://github.com/bugsink/bugsink
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1d0539fefcd1a796143d15d84053b1c0122ef8c7
Fixed
8dca571b9e66c535ed4885465db820824e7c491a
Fixed
dd17221c0deee66e4bf9dec959d71aa49af82156
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
1.*
1.0.0
1.0.1
1.1.0
1.1.1
1.1.2
1.2.0
1.3.0
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
1.6.1
1.6.2
1.6.3
1.7.0
1.7.1
1.7.2
1.7.3
1.7.5
1.7.6
2.*
2.0.0
2.0.0a1
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.2.0
2.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53954.json"