GitHub Advisoryadvisory · PyPI
GHSA-fc2v-vcwj-269v Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
HIGH
Official page ↗
- Aliases
- CVE-2025-64508
- Ecosystem
- PyPI
- Packages
- bugsink
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-770
- Reviewed
- 2025-11-13
Affected packages
• PyPI bugsink: < 2.0.5 → fixed in 2.0.5
Description
Impact
In affected versions, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of Service.
This can be done if the `DSN` is known, which it is in many common setups (JavaScript, Mobile Apps).
Patches
Patched in Bugsink `2.0.5`
Related
Alias · CVE (1)
- CVE-2025-64508 Bugsink is a self-hosted error tracking tool. vulnerability
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://github.com/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v web
- https://nvd.nist.gov/vuln/detail/CVE-2025-64508 advisory
- https://github.com/google/brotli/issues/1327 web
- https://github.com/google/brotli/issues/1375 web
- https://github.com/bugsink/bugsink/pull/266 web
- https://github.com/google/brotli/pull/1234 web
- https://github.com/bugsink/bugsink/commit/3f65544aab3ad5303d97009136640de97b0676a5 web
- https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627 web
- https://github.com/bugsink/bugsink package
- https://github.com/google/brotli/releases/tag/v1.2.0 web