PYSEC-2026-1227 (CVE-2025-64509)

Details

Impact

In affected versions, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service.

This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps).

Patches

Patched in Bugsink 2.0.6

References

The vulnerability in this security advisory is similar to, but distinct from, another brotli-related problem in Bugsink:

https://github.com/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v

Affected Packages

bugsink

PyPI

Affected versions:

0.0.10.1.120.1.130.1.140.1.150.1.160.1.170.1.180.1.190.1.20+36 more

Fixed in:

2.0.6

References

ADVISORY

https://github.com/advisories/GHSA-rrx3-2x4g-mq2h

PACKAGE

https://github.com/bugsink/bugsink

WEB

https://github.com/bugsink/bugsink/commit/1201f754e39265d2aac58edf49dc380bac334388

WEB

https://github.com/bugsink/bugsink/security/advisories/GHSA-rrx3-2x4g-mq2h

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2025-64509

PACKAGE

https://pypi.org/project/bugsink