PyPI/bugsink CVE-2025-64509: high 7.5, EPSS 0.34%

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)

Action: Upgrade bugsink to 2.0.6 or later.

pip install bugsink==2.0.6

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1227
• https://github.com/bugsink/bugsink/security/advisories/GHSA-rrx3-2x4g-mq2h
• https://nvd.nist.gov/vuln/detail/CVE-2025-64509
• https://github.com/bugsink/bugsink/commit/1201f754e39265d2aac58edf49dc380bac334388
• https://github.com/bugsink/bugsink
• https://pypi.org/project/bugsink
• https://github.com/advisories/GHSA-rrx3-2x4g-mq2h

CVE-2025-64509 · published 2026-07-07T16:03:10.164693Z · modified 2026-07-07T17:47:33.578412163Z · JSON