Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M

CVE-2026-52794Sentry: Inefficient Regular Expression Complexity in sentry

High 7.5

In plain English

A high-severity regular-expression denial of service in sentry from getsentry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 54.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.

Affected products (as reported)

Vendor	Product	Versions
getsentry	sentry	>= 24.4.0, < 26.5.2

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/getsentry/sentry/security/advisories/GHSA-jjqr-wqg2-p856 x_refsource_CONFIRM
https://github.com/getsentry/sentry/pull/116587 x_refsource_MISC