High 7.5Published Nov 10, 2025

CVE-2025-64508Bugsink is a self-hosted error tracking tool.

Updated under an hour ago (2026-10-19 08:00 UTC)

Does this affect you?

It lists no affected products yet. Add what you run and Signals checks it as products are added.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Exploited in the last 30 days

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of Service. This can be done if the `DSN` is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink version `2.0.5`. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-rrx3-2x4g-mq2h/CVE-2025-64509.

CVSS: 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Deferred
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

No affected products are listed yet.

References

https://github.com/bugsink/bugsink/commit/3f65544aab3ad5303d97009136640de97b0676a5
https://github.com/bugsink/bugsink/pull/266
https://github.com/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v
https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627
https://github.com/google/brotli/issues/1327
https://github.com/google/brotli/issues/1375
https://github.com/google/brotli/pull/1234
https://github.com/google/brotli/releases/tag/v1.2.0

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.