CyberRota Analysis
AI-GeneratedBugsink versions prior to 2.2.2 are vulnerable to a denial of service due to excessive tag submissions, which can overwhelm the database's single-writer architecture and delay event processing. While this vulnerability does not compromise data integrity or confidentiality, it can disrupt the availability of the error tracking service. Organizations using Bugsink should prioritize upgrading to version 2.2.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.