GHSA-rrx3-2x4g-mq2h

Source

https://github.com/advisories/GHSA-rrx3-2x4g-mq2h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-rrx3-2x4g-mq2h/GHSA-rrx3-2x4g-mq2h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rrx3-2x4g-mq2h

Aliases

CVE-2025-64509

Published

2025-11-13T00:11:26Z

Modified

2025-11-13T00:43:35.427707Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)

Details

Impact

In affected versions, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service.

This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps).

Patches

Patched in Bugsink 2.0.6

References

The vulnerability in this security advisory is similar to, but distinct from, another brotli-related problem in Bugsink:

https://github.com/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v

Database specific

{
    "cwe_ids": [
        "CWE-770"
    ],
    "nvd_published_at": "2025-11-10T22:15:39Z",
    "github_reviewed": true,
    "severity": "HIGH",
    "github_reviewed_at": "2025-11-13T00:11:26Z"
}

References

Affected packages

PyPI / bugsink

Package

Name: bugsink; View open source insights on deps.dev
Purl: pkg:pypi/bugsink

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.6

Affected versions

0.*

0.0.1

0.1.12

0.1.13

0.1.14

0.1.15

0.1.16

0.1.17

0.1.18

0.1.19

0.1.20

1.*

1.0.0

1.0.1

1.1.0

1.1.1

1.1.2

1.2.0

1.3.0

1.4.0

1.4.1

1.4.2

1.4.3

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

2.*

2.0.0a1

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5