Headline
GHSA-rrx3-2x4g-mq2h: Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
Impact
In affected versions, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service.
This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps).
Patches
Patched in Bugsink 2.0.6
References
The vulnerability in this security advisory is similar to, but distinct from, another brotli-related problem in Bugsink:
https://github.com/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2025-64509
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
High severity GitHub Reviewed Published Nov 8, 2025 in bugsink/bugsink • Updated Nov 13, 2025
Package
pip bugsink (pip)
Affected versions
< 2.0.6
Description
Impact
In affected versions, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service.
This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps).
Patches
Patched in Bugsink 2.0.6
References
The vulnerability in this security advisory is similar to, but distinct from, another brotli-related problem in Bugsink:
GHSA-fc2v-vcwj-269v
References
- GHSA-rrx3-2x4g-mq2h
- https://nvd.nist.gov/vuln/detail/CVE-2025-64509
- bugsink/bugsink@1201f75
Published to the GitHub Advisory Database
Nov 13, 2025
Last updated
Nov 13, 2025