Bugsink Denial-of-Service Vulnerability via Crafted Brotli Compression

A denial-of-service vulnerability has been identified in Bugsink, a self-hosted error tracking tool, in versions prior to 2.0.6. The issue arises when a specially crafted Brotli-compressed envelope is processed, causing Bugsink to use excessive CPU resources for decompression. This vulnerability can be exploited if the Data Source Name (DSN) is known, which is often the case in common configurations such as JavaScript and mobile applications.

Impact

Exploitation of this vulnerability leads to a significant increase in CPU usage, causing a denial-of-service condition on the affected system.

Remediation

Users can upgrade to Bugsink version 2.0.6 or later to address this vulnerability.