CVE-2026-44502: falha de média gravidade em bugsink
Bugsink: SSRF bypass in `validate_webhook_url`
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
bugsink · bugsinkCVEs relacionadas — bugsink
No mesmo produto, das mais perigosas para as menos.
CVE-2025-54433HIGHBugsink is vulnerable to Path Traversal attacks via event_id in ingestionEPSS 0.7%CVE-2026-53954MEDIUMBugsink: DOS using large numbers of event tagsEPSS 0.6%CVE-2025-64508HIGHBugsink vulnerable to unauthenticated remote DoS via crafted Brotli inputEPSS 0.5%CVE-2025-64509HIGHBugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)EPSS 0.3%CVE-2026-27614CRITICALBugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace renderingEPSS 0.3%CVE-2026-40162HIGHBugsink affected by authenticated arbitrary file write in artifactbundle/assembleEPSS 0.3%