CVE-2025-64508
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-12

Assigner: GitHub, Inc.

Description
Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of Service. This can be done if the `DSN` is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink version `2.0.5`. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-rrx3-2x4g-mq2h/CVE-2025-64509.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-10
Last Modified
2025-11-12
Generated
2026-06-16
AI Q&A
2025-11-11
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64508
EUVD
EUVD-2025-50818
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
bugsink bugsink 2.0.5
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Bugsink versions prior to 2.0.5 allows an attacker to send highly compressed brotli streams (called brotli "bombs") to the server. The server attempts to decompress these streams before applying limits, which can exhaust available memory and cause a Denial of Service (DoS). This attack can be performed if the DSN is known, which is often the case in common setups like JavaScript or Mobile Apps.

Impact Analysis

The vulnerability can lead to a Denial of Service (DoS) on the Bugsink server by exhausting its available memory through decompression of malicious brotli streams. This can disrupt error tracking services, potentially impacting application monitoring and incident response.

Mitigation Strategies

Upgrade Bugsink to version 2.0.5 or later, as this version contains the patch for the vulnerability. Additionally, restrict access to the DSN to prevent unauthorized sending of highly compressed brotli streams that can cause memory exhaustion and denial of service.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart