CVE-2026-53954
Received Received - Intake

Denial of Service in Bugsink via Excessive Tag Storage

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-53954
EUVD
EUVD-2026-78891

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bugsink bugsink 2.2.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53954 is a denial-of-service vulnerability in Bugsink versions 2.2.1 and earlier. It occurs when an attacker submits an event with an abnormally large number of custom tags. Since Bugsink uses a single-writer database architecture, processing these tags delays ingestion of other events, causing a temporary denial of service. The impact is limited to availability and does not expose data or allow code execution.

Detection Guidance

Monitor for unusually high tag counts in events or excessive database write operations. Check logs for warnings about dropped tags or events exceeding tag limits. Use system monitoring tools to detect delays in event ingestion or increased database load.

Impact Analysis

This vulnerability can cause temporary unavailability of the Bugsink instance. If an attacker submits an event with excessive tags, the system may become unresponsive or slow to process other events. The impact is limited to availability and does not compromise stored data or allow unauthorized access.

Mitigation Strategies

Update Bugsink to version 2.2.2 or later to enforce the MAX_EVENT_TAGS limit. Configure the tag limit to a reasonable value (default is 100) via MAX_EVENT_TAGS in app settings. Review and adjust Docker, local, or singleserver config templates to ensure the limit is applied consistently.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart