CVE-2025-64509High· 7.5▾ TwilightBugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
0.3% → 0.3%
In affected versions, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service.
This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps).
Patched in Bugsink 2.0.6
The vulnerability in this security advisory is similar to, but distinct from, another brotli-related problem in Bugsink:
https://github.com/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v
bugsink < 2.0.6Upgrade to a patched release:
bugsink 2.0.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47715Low· 3.1Bugsink: Issue event views can show an event from another project if its UUID is known
CVE-2026-47716Low· 3.1Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
CVE-2026-44502Medium· 4.3Bunsink has an SSRF bypass in `validate_webhook_url`
CVE-2026-40162High· 7.1Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
CVE-2026-53954Medium· 4.3Bugsink is a self-hosted error tracking tool
CVE-2026-47728Medium· 4.3Bugsink: Project scoping missing in sourcemap and debug-file lookup