Seven people were injured. Two of them are in a critical condition and on life support.
Initial investigations suggested that a man on a rigged motorcycle had rammed into the bus, but a police spokesman said the bomb could have been detonated by remote control.
"We are now looking at the possibility that the motorcycle was placed by the side of the road and detonated as the bus passed," the spokesman said from the scene of the blast just outside the capital's sea port.
The Colombo attack came just hours after the Liberation Tigers of Tamil Eelam staged a pre-dawn raid on a naval base at Delft, claiming to have killed 35 sailors.
"During a search operation, we found 35 bodies of Sri Lankan sailors and weapons," Tiger spokesman Rasiah Ilanthiriyan said from the rebel-held Wanni region.
Four rebels were killed in the operation, he said.
The Sri Lankan military confirmed the rebel attack, saying the Tigers had used about 15 boats, including three so-called "suicide boats".
But a military spokesman dimissed the assertion that 35 sailors were killed as propaganda.
"The Tigers have attacked a small naval detachment on Delft island in Jaffna. Less than 10 sailors are dead," Brigadier Prasad Samarasinghe said.
"We didn't even have 35 people there. That's totally false propaganda."
The latest violence came after the International Red Cross said on Wednesday it had pulled its staff away from frontlines dividing government and rebel forces amid an escalation in the fighting across the island nation.
Sri Lankan troops and Tamil rebels have been locked in combat following the breakdown of a 2002 Norwegian-arranged truce. Nearly 5,000 people have died in the last 18 months.
Hundreds of thousands of civilians have been displaced by the fighting, and Britain and the US have both suspended some aid over human rights abuse claims.