CVE-2025-64508High· 7.5▾ TwilightBugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
0.5% → 0.5%
In affected versions, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of Service.
This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps).
Patched in Bugsink 2.0.5
bugsink < 2.0.5Upgrade to a patched release:
bugsink 2.0.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47715Low· 3.1Bugsink: Issue event views can show an event from another project if its UUID is known
CVE-2026-47716Low· 3.1Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
CVE-2026-44502Medium· 4.3Bunsink has an SSRF bypass in `validate_webhook_url`
CVE-2026-40162High· 7.1Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
CVE-2026-53954Medium· 4.3Bugsink is a self-hosted error tracking tool
CVE-2026-47728Medium· 4.3Bugsink: Project scoping missing in sourcemap and debug-file lookup