Detections
Analytics

SCA: security update for bugsink (GHSA-rrx3-2x4g-mq2h)

high Tenable Self-Hosted Container Security Plugin ID 436027

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-
 compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of
 service. This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile
 Apps). The issue is patched in Bugsink 2.0.6. The vulnerability is similar to, but distinct from, another
 brotli-related problem in Bugsink, GHSA-fc2v-vcwj-269v/CVE-2025-64508. (CVE-2025-64509)

See Also

https://github.com/advisories/GHSA-rrx3-2x4g-mq2h

Plugin Details

Severity: High

ID: 436027

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 11/13/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.69

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-64509

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/13/2025

Vulnerability Publication Date: 11/10/2025

Reference Information

CVE: CVE-2025-64509

cwe: CWE-770