Regular Expression Denial of Service in Sentry

Compliance Impact

The vulnerability described is a Regular Expression Denial of Service (ReDoS) affecting Sentry's event ingestion pipeline, which can lead to high CPU consumption and availability issues.

There is no information provided about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a Regular Expression Denial of Service (ReDoS) issue in Sentry's event ingestion pipeline. It occurs because a regular expression is applied to fields in incoming events that can be controlled by an attacker. By crafting specific input, an attacker can cause the regex to consume excessive CPU resources, leading to a denial of service.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a denial of service by making the system consume disproportionate CPU time when processing attacker-controlled input. This can degrade performance or make the Sentry service unavailable, impacting monitoring and error tracking capabilities.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Sentry to version 26.5.2 or later, where the Regular Expression Denial of Service (ReDoS) issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for sustained high CPU usage in the Sentry processes responsible for event ingestion, specifically the taskworker and events-consumer processes.

Since the vulnerability involves a Regular Expression Denial of Service (ReDoS) triggered by attacker-controlled fields in incoming events, observing unusually high CPU consumption or degraded ingestion throughput may indicate exploitation attempts.

Suggested commands to detect this condition include:

• Use top or htop to monitor CPU usage of Sentry processes: `top -p $(pgrep -d',' -f 'sentry.taskworker|sentry.events-consumer')`
• Use ps to check CPU usage snapshot: `ps -eo pid,comm,pcpu --sort=-pcpu | grep -E 'sentry.taskworker|sentry.events-consumer'`
• Check logs for unusual event ingestion delays or errors related to regex processing.

Additionally, operators should consider applying rate limits on publicly exposed DSNs to mitigate potential abuse.

Useful 0 Not Useful 0