CVE-2025-64508 in Bugsink
Summary
by MITRE • 11/11/2025
Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of Service. This can be done if the `DSN` is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink version `2.0.5`. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-rrx3-2x4g-mq2h/CVE-2025-64509.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/11/2025
CVE-2025-64508 represents a denial of service vulnerability affecting Bugsink versions prior to 2.0.5, where the application fails to properly validate brotli compressed data streams before attempting decompression. This flaw occurs when the server receives highly compressed brotli streams that contain repetitive patterns such as sequences of zeros, which can be exploited to trigger memory exhaustion during decompression operations. The vulnerability stems from the server's processing logic where decompression occurs before any size limitations are enforced, creating a window where maliciously crafted compressed data can consume excessive system resources. The issue is particularly concerning because the DSN (Data Source Name) required for exploitation is commonly known in typical deployment scenarios involving JavaScript applications and mobile apps, making the attack surface more accessible than initially apparent.
The technical implementation of this vulnerability aligns with CWE-400, which addresses unchecked resource consumption, specifically focusing on improper handling of compressed data streams. The flaw demonstrates characteristics consistent with resource exhaustion attacks where attackers can manipulate input data to cause disproportionate resource usage during processing. In the context of the ATT&CK framework, this vulnerability maps to T1499.004, which covers network denial of service attacks through resource consumption, and potentially T1595.001 for reconnaissance activities that identify exploitable configurations. The vulnerability's exploitation requires knowledge of the DSN, which is typically exposed in client-side applications, making it a significant concern for applications with public-facing error tracking endpoints.
The operational impact of CVE-2025-64508 extends beyond simple service disruption to potentially compromise system stability and availability. When exploited, the vulnerability can cause memory exhaustion that leads to application crashes, system instability, or complete service unavailability, particularly in environments where Bugsink serves as a critical error monitoring component. The memory consumption occurs during the decompression phase before any input validation or size limiting mechanisms are applied, meaning that even small compressed inputs can result in massive memory allocations. This makes the vulnerability particularly dangerous in production environments where resource constraints are already tight and where the application might be handling multiple concurrent error reports from various client applications. The similarity to CVE-2025-64509 indicates that Bugsink's decompression handling logic contains systemic weaknesses that require comprehensive review and remediation. The fix implemented in version 2.0.5 addresses this by introducing proper input validation and size limiting before decompression operations, ensuring that compressed data streams are checked against reasonable bounds before any decompression processing begins. Organizations should prioritize updating to version 2.0.5 or later to mitigate this vulnerability and prevent potential denial of service scenarios that could impact error tracking and monitoring capabilities.