CVE-2025-64509
Last modified
CVE-2025-64509 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service. This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps). The issue is patched in Bugsink 2.0.6. The vulnerability is similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-fc2v-vcwj-269v/CVE-2025-64508.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-64509?
How severe is CVE-2025-64509?
How do I fix CVE-2025-64509?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-64503cups-filters contains backends, filters, and other software …3.3
- CVE-2025-64504Langfuse is an open source large language model engineering …5
- CVE-2025-64505LIBPNG is a reference library for use in applications that r…6.1
- CVE-2025-64506LIBPNG is a reference library for use in applications that r…6.1
- CVE-2025-64507Incus is a system container and virtual machine manager. An …7.8
- CVE-2025-64508Bugsink is a self-hosted error tracking tool. In versions pr…7.5
- CVE-2025-6451A vulnerability was found in code-projects Simple Online Hot…9.8
- CVE-2025-64511MaxKB is an open-source AI assistant for enterprise. In vers…8.8
- CVE-2025-64512Pdfminer.six is a community maintained fork of the original …7.8
- CVE-2025-64513Milvus is an open-source vector database built for generativ…9.3
- CVE-2025-64515Open Forms allows users create and publish smart forms. Prio…4.3
- CVE-2025-64516GLPI is a free asset and IT management software package. Pri…7.5
Are you affected by CVE-2025-64509?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST