high 7.5

CVE-2025-6176 json

Brotli decompression bomb DoS in scrapy/scrapy

published 2025-10-31 12 mo ago modified 2026-09-10 1 mo ago also GHSA-2qfp-q593-8484 , PYSEC-2026-1906 , PYSEC-2026-2401 , EUVD-2025-37237

cvss: 7.5; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

Patch / fix

fixed in 2 distros 5 links 5

pypi brotli 1.2.0
pypi scrapy 2.13.4

debian red hat opensuse almalinux rocky linux

python-scrapy Debian 14 2.13.4-1

debian advisories DEBIAN-CVE-2025-6176

foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.14-1.el8sat
foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.14-1.el9sat
foreman-cli satellite utils 6.16, satellite 6.16 3.12.0.14-1.el8sat
foreman-cli satellite utils 6.16, satellite 6.16 3.12.0.14-1.el9sat
foreman-ec2 satellite 6.16 3.12.0.14-1.el8sat
foreman-ec2 satellite 6.16 3.12.0.14-1.el9sat
foreman-pcp satellite capsule 6.16, satellite 6.16 3.12.0.14-1.el8sat
foreman-pcp satellite capsule 6.16, satellite 6.16 3.12.0.14-1.el9sat

red hat advisories RHSA-2026:5971 RHSA-2026:5970 RHSA-2026:2455 RHSA-2026:2401 RHSA-2026:2389 RHSA-2026:2400

python-Brotli openSUSE Leap 16.0 1.2.1-160000.1.1
python-py7zr openSUSE Tumbleweed 1.1.0-1.1
python-Brotli openSUSE Tumbleweed 1.2.0-1.1
python-Scrapy openSUSE Tumbleweed 2.13.3-2.1

opensuse advisories openSUSE-SU-2026:22183-1 openSUSE-SU-2026:10227-1 openSUSE-SU-2025:15731-1 openSUSE-SU-2025:15732-1

brotli AlmaLinux 8 1.0.6-4.el8_10
python3-brotli AlmaLinux 8 1.0.6-4.el8_10
brotli AlmaLinux 9 1.0.9-9.el9_7
libbrotli AlmaLinux 9 1.0.9-9.el9_7
python3-brotli AlmaLinux 9 1.0.9-9.el9_7
brotli AlmaLinux 10 1.1.0-7.el10_1
libbrotli AlmaLinux 10 1.1.0-7.el10_1
python3-brotli AlmaLinux 10 1.1.0-7.el10_1

almalinux advisories ALSA-2026:2389 ALSA-2026:2042 ALSA-2026:0845

brotli Rocky Linux 8 1.0.6-4.el8_10
brotli Rocky Linux 9 1.0.9-9.el9_7
brotli Rocky Linux 10 1.1.0-7.el10_1

rocky linux advisories RLSA-2026:2389 RLSA-2026:2042 RLSA-2026:0845

github.com/google/brotli@67d78bc commit
github.com/scrapy/scrapy@14737e9 commit
github.com/google/brotli#1234 pull request
github.com/scrapy/scrapy#7134 pull request
github.com/google/brotli/releases/tag/v1.2.0 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-6176 updated 2026-10-09 cvss 7.5

Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS

Red Hat Ansible Automation Platform 2 python3x-brotli, ansible-automation-platform-tech-preview/automation-dashboard-rhel9
affected: workaround, no fix available, no fix planned “Out of support scope”
Red Hat Ceph Storage 8 rhceph/grafana-rhel9 Red Hat Satellite 6 python-brotli
affected: workaround, no fix available
Red Hat Ceph Storage 7 rhceph 1770632724
fixed: vendor fix RHSA-2026:2800
Red Hat Ceph Storage 8 rhceph 1770630907
fixed: vendor fix RHSA-2026:2737
Red Hat Ceph Storage 9 rhceph 1771816028
fixed: vendor fix RHSA-2026:3406
Red Hat Enterprise Linux AppStream (v. 8) python3-brotli 1.0.6-4.el8_10
fixed: vendor fix RHSA-2026:2389
Red Hat Enterprise Linux AppStream (v. 9) brotli 1.0.9-9.el9_7, python3-brotli 1.0.9-9.el9_7
fixed: vendor fix RHSA-2026:2042
Red Hat Enterprise Linux AppStream (v. 10) brotli 1.1.0-7.el10_1, python3-brotli 1.1.0-7.el10_1
fixed: vendor fix RHSA-2026:0845

show 29 more

Red Hat Enterprise Linux AppStream AUS (v.8.4) python3-brotli 1.0.6-4.el8_4
fixed: vendor fix RHSA-2026:2399
Red Hat Enterprise Linux AppStream AUS (v.8.6) python3-brotli 1.0.6-4.el8_6 Red Hat Enterprise Linux AppStream E4S (v.8.6) python3-brotli 1.0.6-4.el8_6
fixed: vendor fix RHSA-2026:2455
Red Hat Enterprise Linux AppStream E4S (v.8.8) python3-brotli 1.0.6-4.el8_8
fixed: vendor fix RHSA-2026:2400
Red Hat Enterprise Linux AppStream E4S (v.9.0) brotli 1.0.9-6.el9_0.1, python3-brotli 1.0.9-6.el9_0.1
fixed: vendor fix RHSA-2026:2226
Red Hat Enterprise Linux AppStream E4S (v.9.2) brotli 1.0.9-6.el9_2.1, python3-brotli 1.0.9-6.el9_2.1
fixed: vendor fix RHSA-2026:2228
Red Hat Enterprise Linux AppStream EUS (v. 10.0) brotli 1.1.0-6.el10_0.1, python3-brotli 1.1.0-6.el10_0.1
fixed: vendor fix RHSA-2026:0008
Red Hat Enterprise Linux AppStream EUS (v.9.4) brotli 1.0.9-6.el9_4.1, python3-brotli 1.0.9-6.el9_4.1
fixed: vendor fix RHSA-2026:2227
Red Hat Enterprise Linux AppStream EUS (v.9.6) brotli 1.0.9-7.el9_6.1, python3-brotli 1.0.9-7.el9_6.1
fixed: vendor fix RHSA-2026:2229
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) python3-brotli 1.0.6-4.el8_4
fixed: vendor fix RHSA-2026:2399
Red Hat Enterprise Linux AppStream TUS (v.8.6) python3-brotli 1.0.6-4.el8_6
fixed: vendor fix RHSA-2026:2455
Red Hat Enterprise Linux AppStream TUS (v.8.8) python3-brotli 1.0.6-4.el8_8
fixed: vendor fix RHSA-2026:2400
Red Hat Enterprise Linux BaseOS (v. 8) brotli 1.0.6-4.el8_10
fixed: vendor fix RHSA-2026:2389
Red Hat Enterprise Linux BaseOS (v. 9) brotli 1.0.9-9.el9_7, libbrotli 1.0.9-9.el9_7
fixed: vendor fix RHSA-2026:2042
Red Hat Enterprise Linux BaseOS (v. 10) brotli 1.1.0-7.el10_1, libbrotli 1.1.0-7.el10_1
fixed: vendor fix RHSA-2026:0845
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) brotli 1.0.6-1.el8_2.1
fixed: vendor fix RHSA-2026:2401
Red Hat Enterprise Linux BaseOS AUS (v.8.4) brotli 1.0.6-4.el8_4
fixed: vendor fix RHSA-2026:2399
Red Hat Enterprise Linux BaseOS AUS (v.8.6) brotli 1.0.6-4.el8_6 Red Hat Enterprise Linux BaseOS E4S (v.8.6) brotli 1.0.6-4.el8_6
fixed: vendor fix RHSA-2026:2455
Red Hat Enterprise Linux BaseOS E4S (v.8.8) brotli 1.0.6-4.el8_8
fixed: vendor fix RHSA-2026:2400
Red Hat Enterprise Linux BaseOS E4S (v.9.0) brotli 1.0.9-6.el9_0.1, libbrotli 1.0.9-6.el9_0.1
fixed: vendor fix RHSA-2026:2226
Red Hat Enterprise Linux BaseOS E4S (v.9.2) brotli 1.0.9-6.el9_2.1, libbrotli 1.0.9-6.el9_2.1
fixed: vendor fix RHSA-2026:2228
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) brotli 1.1.0-6.el10_0.1, libbrotli 1.1.0-6.el10_0.1
fixed: vendor fix RHSA-2026:0008
Red Hat Enterprise Linux BaseOS EUS (v.9.4) brotli 1.0.9-6.el9_4.1, libbrotli 1.0.9-6.el9_4.1
fixed: vendor fix RHSA-2026:2227
Red Hat Enterprise Linux BaseOS EUS (v.9.6) brotli 1.0.9-7.el9_6.1, libbrotli 1.0.9-7.el9_6.1
fixed: vendor fix RHSA-2026:2229
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) brotli 1.0.6-4.el8_4
fixed: vendor fix RHSA-2026:2399
Red Hat Enterprise Linux BaseOS TUS (v.8.6) brotli 1.0.6-4.el8_6
fixed: vendor fix RHSA-2026:2455
Red Hat Enterprise Linux BaseOS TUS (v.8.8) brotli 1.0.6-4.el8_8
fixed: vendor fix RHSA-2026:2400
Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202603041314
fixed: vendor fix RHSA-2026:3861
Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202602240113
fixed: vendor fix RHSA-2026:3415
Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202602171627
fixed: vendor fix RHSA-2026:2974

9 more fixed, 11 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 12 mo ago (2025-10-31)

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	brotli	<1.2.0	1.2.0
pypi	scrapy	<2.13.4	2.13.4

Affected products

scrapy scrapy/scrapy

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

github.com /google/brotli/pull/1234
web
github.com /scrapy/scrapy/pull/7134
web
github.com /google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627
web
github.com /scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da
web, patch
huntr.com /bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0
web
nvd.nist.gov /vuln/detail/CVE-2025-6176
advisory
github.com /google/brotli/issues/1327
web
github.com /google/brotli/issues/1375
web
github.com /google/brotli
package
github.com /google/brotli/releases/tag/v1.2.0
web
pypi.org /project/brotli
package
github.com /advisories/GHSA-2qfp-q593-8484
advisory
pypi.org /project/scrapy
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary