CVE-2026-52794 is a ReDoS vulnerability in the getsentry Sentry product affecting versions from 24.4.0 to before 26.5.2. The vulnerability arises from inefficient regular expression complexity in the event ingestion pipeline, where regex applied to attacker-controlled fields can be exploited to consume disproportionate CPU resources. This can lead to denial of service by degrading system availability. The vulnerability is fixed in version 26.5.2. There are no known exploits in the wild as of the published date.

The vulnerability impacts availability by enabling an attacker to cause high CPU usage through crafted input fields, potentially leading to denial of service conditions. There is no impact on confidentiality or integrity. The CVSS score of 7.5 reflects a high severity due to the network attack vector, low attack complexity, no required privileges or user interaction, and the impact on availability only.

Upgrade Sentry to version 26.5.2 or later, where this ReDoS vulnerability is fixed. Since this is a self-hosted product, users must apply the update themselves. Patch status is confirmed by the version fixed statement in the description. No other mitigations are specified.