CVE-2026-53954

Name of the Vulnerable Software and Affected Versions Bugsink versions prior to 2.2.2

Description Bugsink stores every tag provided with an incoming event. An attacker can submit an event containing an unusually large number of custom tags, causing the ingestion process to spend excessive time writing tag rows. Because Bugsink utilizes a single-writer database architecture, a single expensive write transaction can delay the digestion of other events, resulting in a temporary denial of service. This issue requires a valid project DSN (Data Source Name) to submit the event. The impact is limited to availability and does not allow for data exposure, modification of events, or code execution.

Recommendations Update to version 2.2.2. Adjust the MAX EVENT TAGS variable to modify the default cap of 100 tags stored per event.