Search: CVE-2025-64508

Bugsink versions prior to 2.0.5 are vulnerable to a denial of service caused by resource exhaustion when processing specially crafted brotli compressed streams known as brotli "bombs." An attacker who knows the DSN can send these highly compressed streams that decompress to large memory allocations, exhausting server memory before decompression limits are applied. This vulnerability is fixed in version 2.0.5.