PyPI/bugsink CVE-2025-64508: high 7.5, EPSS 0.51%

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input

Action: Upgrade bugsink to 2.0.5 or later.

pip install bugsink==2.0.5

Affected

Fixed versions

Sources

• osv: GHSA-fc2v-vcwj-269v
• https://github.com/bugsink/bugsink/security/advisories/GHSA-fc2v-vcwj-269v
• https://nvd.nist.gov/vuln/detail/CVE-2025-64508
• https://github.com/google/brotli/issues/1327
• https://github.com/google/brotli/issues/1375
• https://github.com/bugsink/bugsink/pull/266
• https://github.com/google/brotli/pull/1234
• https://github.com/bugsink/bugsink/commit/3f65544aab3ad5303d97009136640de97b0676a5
• https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627
• https://github.com/bugsink/bugsink
• https://github.com/google/brotli/releases/tag/v1.2.0

CVE-2025-64508 · published 2025-11-13T00:10:50Z · modified 2026-07-07T17:57:28.581611571Z · JSON