CVE-2025-64509
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-12

Assigner: GitHub, Inc.

Description
Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service. This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink 2.0.6. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-fc2v-vcwj-269v/CVE-2025-64508.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-10
Last Modified
2025-11-12
Generated
2026-06-16
AI Q&A
2025-11-11
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64509
EUVD
EUVD-2025-50819
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
bugsink bugsink 2.0.6
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Bugsink versions prior to 2.0.6 involves a specially crafted Brotli-compressed envelope that causes the software to spend excessive CPU time during decompression. This leads to a denial of service condition. The attack requires knowledge of the DSN, which is commonly known in many setups such as JavaScript and Mobile Apps. The issue has been fixed in Bugsink version 2.0.6.

Impact Analysis

The vulnerability can cause a denial of service by making Bugsink consume excessive CPU resources during decompression of a maliciously crafted Brotli-compressed envelope. This can disrupt the availability of the error tracking service, potentially impacting application monitoring and incident response.

Mitigation Strategies

Upgrade Bugsink to version 2.0.6 or later, as this version contains the patch that fixes the vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64509. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart