7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64508

CVE-2025-64508: Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input

Impact

In affected versions, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of Service.

This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps).

Patches

Patched in Bugsink 2.0.5

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64508

CVE-2025-64508:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bugsink	pip	< 2.0.5	2.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the way the bugsink application handles Brotli decompression. The brotli_generator function in bugsink/streams.py was responsible for decompressing incoming data. However, it did not impose any limits on the size of the decompressed data. This allowed an attacker to send a "brotli bomb"—a small, highly compressed file that expands to a massive size—and cause the server to run out of memory, resulting in a denial of service. The fix, implemented in commit 3f65544aab3ad5303d97009136640de97b0676a5, involves two main changes. First, the Brotli library was upgraded to a version that supports an output_buffer_limit in its decompressor. Second, the brotli_generator function was modified to use this new feature, thereby chunking the decompression process and preventing uncontrolled memory allocation. The GeneratorReader.read method was also identified as part of the vulnerable execution flow, as it would be the function to trigger the large memory allocation by attempting to read the entire decompressed stream at once.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.