CVE-2025-64508
BaseFortify
Publication date: 2025-11-10
Last updated on: 2025-11-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bugsink | bugsink | 2.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Bugsink versions prior to 2.0.5 allows an attacker to send highly compressed brotli streams (called brotli "bombs") to the server. The server attempts to decompress these streams before applying limits, which can exhaust available memory and cause a Denial of Service (DoS). This attack can be performed if the DSN is known, which is often the case in common setups like JavaScript or Mobile Apps.
How can this vulnerability impact me? :
The vulnerability can lead to a Denial of Service (DoS) on the Bugsink server by exhausting its available memory through decompression of malicious brotli streams. This can disrupt error tracking services, potentially impacting application monitoring and incident response.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Bugsink to version 2.0.5 or later, as this version contains the patch for the vulnerability. Additionally, restrict access to the DSN to prevent unauthorized sending of highly compressed brotli streams that can cause memory exhaustion and denial of service.