Log in Start free

Vulnerability · Published Nov 10, 2025 · Assigned by GitHub_M

CVE-2025-64508Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input

High 7.5

In plain English

A high-severity resource allocation without limits in bugsink from bugsink. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 56.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of Service. This can be done if the `DSN` is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink version `2.0.5`. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-rrx3-2x4g-mq2h/CVE-2025-64509.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIbugsink2.0.5GHSA-fc2v-vcwj-269v
PyPIbugsink2.0.5PYSEC-2026-1225

Affected products (as reported)

VendorProductVersions
bugsink bugsink < 2.0.5

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References