CVE-2025-64509

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-12

Assigner: GitHub, Inc.

Description

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service. This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink 2.0.6. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-fc2v-vcwj-269v/CVE-2025-64508.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-10

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64509

EUVD

EUVD-2025-50819

Affected Vendors & Products

Vendor	Product	Version / Range
bugsink	bugsink	2.0.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in Bugsink versions prior to 2.0.6 involves a specially crafted Brotli-compressed envelope that causes the software to spend excessive CPU time during decompression. This leads to a denial of service condition. The attack requires knowledge of the DSN, which is commonly known in many setups such as JavaScript and Mobile Apps. The issue has been fixed in Bugsink version 2.0.6.

Impact Analysis

The vulnerability can cause a denial of service by making Bugsink consume excessive CPU resources during decompression of a maliciously crafted Brotli-compressed envelope. This can disrupt the availability of the error tracking service, potentially impacting application monitoring and incident response.

Mitigation Strategies

Upgrade Bugsink to version 2.0.6 or later, as this version contains the patch that fixes the vulnerability.

Hi! I’m here to help you understand CVE-2025-64509. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70