CVE-2025-64508: Bugsink Remote DoS Vulnerability via Crafted Brotli Input
Summary
CVE-2025-64508: Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input. Affects bugsink versions < 2.0.5. Fixed in 2.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Bugsink is an open-source library designed for error tracking and monitoring in applications. It provides developers with tools to capture and analyze errors in real-time, facilitating improved application stability and user experience. However, Bugsink is vulnerable to a specific Denial of Service (DoS) attack that exploits its Brotli compression handling, allowing attackers to send specially crafted input that can exhaust server memory.
Vulnerability Detail
The vulnerability arises from the way Bugsink processes Brotli compressed streams. Attackers can send 'brotli bombs'—highly compressed streams that contain excessive amounts of data (like many zeros)—to the server. When the server attempts to decompress these streams, it can lead to memory exhaustion, resulting in a Denial of Service. This attack can be executed if the Data Source Name (DSN) is known, which is often the case in common setups such as JavaScript and mobile applications.
How To Fix
Minimum fixed version
2.0.5
This is the first release that contains the fix.
pip install --upgrade "bugsink==2.0.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to reject overly large or suspicious Brotli streams before they are processed by the server. This can help mitigate the risk of memory exhaustion until the package is updated.
Conclusion
In summary, Bugsink is vulnerable to a Denial of Service attack through crafted Brotli input, which can lead to memory exhaustion on the server. It is crucial to update to version 2.0.5 or later to mitigate this risk. Implementing input validation can serve as a temporary workaround while you prepare for the update.
See every vulnerability recorded for bugsink →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Brotli bombs are specially crafted Brotli compressed streams that contain excessive data, designed to exploit vulnerabilities in decompression algorithms.
Yes, implementing input validation to reject suspicious Brotli streams can help mitigate the risk until you can update to the patched version.
If upgrading is not possible, ensure that your application has robust input validation and monitoring in place to detect and respond to potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for bugsink.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
