CVE-2026-53954 json
Bugsink: DOS using large numbers of event tags
published 5mo ago modified last mo. also EUVD-2026-78891 , GHSA-5x67-j5xg-c5gj , PYSEC-2026-2403
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.
Patch / fix
- pypi bugsink 2.2.2
- bugsink bugsink 2.2.2
Is CVE-2026-53954 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | bugsink | <2.2.2 |
2.2.2 |
Affected products
- bugsink bugsink
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
- github.com /bugsink/bugsink/commit/1d0539fefcd1a796143d15d84053b1c0122ef8c7
- github.com /bugsink/bugsink/commit/8dca571b9e66c535ed4885465db820824e7c491a
-
github.com
/bugsink/bugsink/security/advisories/GHSA-5x67-j5xg-c5gj
web
-
github.com
/bugsink/bugsink/releases/tag/2.2.2
web
-
github.com
/bugsink/bugsink
package
-
pypi.org
/project/bugsink
package
-
github.com
/advisories/GHSA-5x67-j5xg-c5gj
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-53954
advisory
Sources
- CVE List CVE-2026-53954
- GitHub Advisory GHSA-5x67-j5xg-c5gj
- NVD CVE-2026-53954
- OSV PYSEC-2026-2403
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.