CVE-2025-6176 Brotli decompression bomb DoS in scrapy/scrapy
Remote servers can crash Scrapy clients via brotli decompression bombs, causing excessive memory consumption and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-6176?
CVE-2025-6176 is a high-severity denial of service vulnerability in scrapy/scrapy, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.
Weakness: CWE-400
Which versions are affected by CVE-2025-6176?
6 open source packages ship an affected version, including brotli, Scrapy and scrapy.
| Package | Affected | Fixed in |
|---|---|---|
brotli PyPI | All versions | 1.2.0 |
brotli PyPI | All versions | 1.2.0 |
brotli PyPI | All versions | 1.2.0 |
Scrapy PyPI | All versions | 2.13.4 |
scrapy PyPI | All versions | 2.13.4 |
scrapy PyPI | All versions | 2.13.4 |
Linux distribution packages (34)
brotli AlmaLinux:10 | All versions | 1.1.0-7.el10_1 |
brotli-devel AlmaLinux:10 | All versions | 1.1.0-7.el10_1 |
libbrotli AlmaLinux:10 | All versions | 1.1.0-7.el10_1 |
python3-brotli AlmaLinux:10 | All versions | 1.1.0-7.el10_1 |
brotli AlmaLinux:8 | All versions | 1.0.6-4.el8_10 |
brotli-devel AlmaLinux:8 | All versions | 1.0.6-4.el8_10 |
python3-brotli AlmaLinux:8 | All versions | 1.0.6-4.el8_10 |
brotli AlmaLinux:9 | All versions | 1.0.9-9.el9_7 |
brotli-devel AlmaLinux:9 | All versions | 1.0.9-9.el9_7 |
libbrotli AlmaLinux:9 | All versions | 1.0.9-9.el9_7 |
python3-brotli AlmaLinux:9 | All versions | 1.0.9-9.el9_7 |
brotli Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 |
brotli-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 |
brotli-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 |
brotli-devel Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 |
libbrotli Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 |
libbrotli-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 |
python3-brotli Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 |
python3-brotli-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 |
brotli-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 |
brotli-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 |
brotli-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 |
python3-brotli Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 |
python3-brotli-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 |
brotli Red Hat:enterprise_linux:8::baseos | All versions | 0:1.0.6-4.el8_10 |
brotli-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.0.6-4.el8_10 |
brotli-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:1.0.6-4.el8_10 |
python3-brotli-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.0.6-4.el8_10 |
brotli Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 |
brotli-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 |
brotli-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 |
brotli-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 |
libbrotli-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 |
python3-brotli Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 |
How do I fix CVE-2025-6176?
Upgrade brotli to 1.2.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-6176 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6176 exists.
Sources
Also known as ALSA-2026:0845, ALSA-2026:2042, ALSA-2026:2389, CLSA-2026-1770911059, CLSA-2026-1770911837, DEBIAN-CVE-2025-6176 and 32 more.