-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a denial-of-service in the Brotli decompression process in bugsink. The analysis of the provided patch commit 1201f754e39265d2aac58edf49dc380bac334388 points directly to the brotli_generator function in bugsink/streams.py as the source of the vulnerability. The patch modifies this function to add checks that prevent an infinite loop during decompression. A malicious actor could send a crafted Brotli-compressed payload that would cause the original code to loop indefinitely, consuming CPU resources and making the service unresponsive. The vulnerable function, brotli_generator, would be visible in a runtime profile during an exploit, as it would be stuck in a tight loop. The fix involves adding assertions to ensure that the decompressor is always making progress, either by producing data or by reaching a finished state.
brotli_generatorbugsink/streams.py
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bugsink | pip | < 2.0.6 | 2.0.6 |
Ongoing coverage of React2Shell