CVE-2025-64508 json
Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input
published 11mo ago modified 4mo ago also GHSA-fc2v-vcwj-269v , PYSEC-2026-1225 , EUVD-2025-50818
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of Service. This can be done if the `DSN` is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink version `2.0.5`. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-rrx3-2x4g-mq2h/CVE-2025-64509.
Patch / fix
- pypi bugsink 2.0.5
- github.com/bugsink/bugsink@3f65544 commit
- github.com/google/brotli@67d78bc commit
- github.com/bugsink/bugsink#266 pull request
- github.com/google/brotli#1234 pull request
- github.com/google/brotli/releases/tag/v1.2.0 release
Is CVE-2025-64508 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 11mo ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | bugsink | <2.0.5 |
2.0.5 |
Affected products
- bugsink bugsink
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/bugsink/bugsink/pull/266
web
-
github.com
/google/brotli/pull/1234
web
-
github.com
/bugsink/bugsink/commit/3f65544aab3ad5303d97009136640de97b0676a5
web
-
github.com
/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627
web
-
github.com
/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v
web
-
github.com
/google/brotli/issues/1327
web
-
github.com
/google/brotli/issues/1375
web
-
github.com
/google/brotli/releases/tag/v1.2.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-64508
advisory
-
github.com
/bugsink/bugsink
package
-
pypi.org
/project/bugsink
package
-
github.com
/advisories/GHSA-fc2v-vcwj-269v
advisory
Sources
- CVE List CVE-2025-64508
- GitHub Advisory GHSA-fc2v-vcwj-269v
- NVD CVE-2025-64508
- OSV PYSEC-2026-1225
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.