CVE-2025-64508

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-12

Assigner: GitHub, Inc.

Description

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of Service. This can be done if the `DSN` is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink version `2.0.5`. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-rrx3-2x4g-mq2h/CVE-2025-64509.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-10

Last Modified

2025-11-12

Generated

2026-07-07

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64508

EUVD

EUVD-2025-50818

Affected Vendors & Products

Vendor	Product	Version / Range
bugsink	bugsink	2.0.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in Bugsink versions prior to 2.0.5 allows an attacker to send highly compressed brotli streams (called brotli "bombs") to the server. The server attempts to decompress these streams before applying limits, which can exhaust available memory and cause a Denial of Service (DoS). This attack can be performed if the DSN is known, which is often the case in common setups like JavaScript or Mobile Apps.

Impact Analysis

The vulnerability can lead to a Denial of Service (DoS) on the Bugsink server by exhausting its available memory through decompression of malicious brotli streams. This can disrupt error tracking services, potentially impacting application monitoring and incident response.

Mitigation Strategies

Upgrade Bugsink to version 2.0.5 or later, as this version contains the patch for the vulnerability. Additionally, restrict access to the DSN to prevent unauthorized sending of highly compressed brotli streams that can cause memory exhaustion and denial of service.

Hi! I’m here to help you understand CVE-2025-64508. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70