Detections
Analytics
SCA: security update for bugsink (GHSA-fc2v-vcwj-269v)
high Tenable Cloud Security Plugin ID 436028
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly
compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to
decompress these streams before applying various maximums, this can lead to exhaustion of the available
memory and thus a Denial of Service. This can be done if the `DSN` is known, which it is in many common
setups (JavaScript, Mobile Apps). The issue is patched in Bugsink version `2.0.5`. The vulnerability is
similar to, but distinct from, another brotli-related problem in Bugsink, GHSA-
rrx3-2x4g-mq2h/CVE-2025-64509. (CVE-2025-64508)
See Also
Plugin Details
Severity: High
ID: 436028
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 11/13/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.7
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2025-64508
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 11/13/2025
Vulnerability Publication Date: 11/10/2025
Reference Information
CVE: CVE-2025-64508
cwe: CWE-770