GHSA-rrx3-2x4g-mq2h

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)

Source: GitHub Advisory Database (reviewed) High CVE-2025-64509

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	bugsink	< 2.0.6	2.0.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact In affected versions, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service. This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps). ### Patches Patched in Bugsink 2.0.6 ### References The vulnerability in this security advisory is similar to, but distinct from, another brotli-related problem in Bugsink: https://github.com/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v

References

External links from the advisory. They lead to third-party sites.

https://github.com/bugsink/bugsink/security/advisories/GHSA-rrx3-2x4g-mq2h web
https://nvd.nist.gov/vuln/detail/CVE-2025-64509 advisory
https://github.com/bugsink/bugsink/commit/1201f754e39265d2aac58edf49dc380bac334388 web
https://github.com/bugsink/bugsink package