PT-2025-46207 · Bugsink · Bugsink

Published 2025-11-10 · Updated 2025-11-13 · CVE-2025-64508

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Bugsink versions prior to 2.0.5

Description Bugsink is a self-hosted error tracking tool susceptible to a Denial of Service. Specifically, specially crafted brotli compressed data streams, known as “bombs” (highly compressed brotli streams containing many zeros), can be sent to the server. The server attempts to decompress these streams before applying memory limits, leading to memory exhaustion and a denial of service. This exploitation requires knowledge of the DSN. This issue is distinct from a related brotli problem, GHSA-rrx3-2x4g-mq2h.

Recommendations Update Bugsink to version 2.0.5 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-64508

GHSA-FC2V-VCWJ-269V

Affected Products

Bugsink

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64508.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-64508 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fc2v-vcwj-269v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64508 · Security Note
• https://github.com/google/brotli/issues/1327 · Note
• https://github.com/google/brotli/pull/1234 · Note
• https://github.com/google/brotli/releases/tag/v1.2.0 · Note
• https://github.com/google/brotli/issues/1375 · Note
• https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627 · Note
• https://github.com/bugsink/bugsink · Note
• https://github.com/bugsink/bugsink/commit/3f65544aab3ad5303d97009136640de97b0676a5 · Note
• https://github.com/bugsink/bugsink/pull/266 · Note
• https://github.com/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v · Note
• https://twitter.com/CVEnew/status/1988003178848116781 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988147634444406926 · Twitter Post