CVE Feed

    Dashboard / CVE / CVE-2025-64509

    CVE-2025-64509

    Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service. This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink 2.0.6. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-fc2v-vcwj-269v/CVE-2025-64508.

    Published:Nov 10, 2025
    Last Modified:Apr 15, 2026
    EPS:Nov 10, 2025
    EPSS Score:0.00091
    CVSS Score:7.5

    Affected Products

    Vendor
    Bugsink
    Product
    Bugsink

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-47716 (CVSS 3.1) — Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view author…
    CVE-2026-47715 (CVSS 3.1) — Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event …
    CVE-2026-47728 (CVSS 4.3) — Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by d…
    CVE-2026-44502 (CVSS 4.3) — Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (parti…
    CVE-2026-40162 (CVSS 7.1) — Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identifi…
    CVE-2026-27614 (CVSS 9.3) — Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can…
    CVE-2025-64508 (CVSS 7.5) — Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed br…
    CVE-2025-54433 (CVSS 7.2) — Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 throu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High