A weakness in Sentry’s event ingestion pipeline allows an attacker to submit crafted event data that contains a regular expression with high complexity, causing the server to consume excessive CPU resources and potentially become unresponsive. This flaw is characterized as a Regular Expression Denial of Service, a classic example of CWE‑1333, and directly impacts the availability of the Sentry service.

The vulnerability affects the Sentry error‑tracking platform (getsentry:sentry), specifically all releases from version 24.4.0 up to, but not including, 26.5.2. Users running any of those versions are susceptible to the denial of service.

The CVSS score of 7.5 indicates high impact, while the EPSS score is not available, suggesting the exact exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending maliciously crafted events to the ingestion API, which does not require special privileges. Successful exploitation would consume CPU, degrade service performance, and could lead to a denial of service for legitimate users.