{"answers":{"affected":"6 open source packages ship an affected version, including brotli, Scrapy and scrapy.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6176 exists.","fix":"Upgrade brotli to 1.2.0 or later.","what":"CVE-2025-6176 is a high-severity denial of service vulnerability in scrapy/scrapy, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-6176 and fix it if it is affected.\n\nWhat it is: CVE-2025-6176 is a high-severity denial of service vulnerability in scrapy/scrapy, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6176 exists.\n\nAffected packages and fixed versions:\n- brotli (PyPI): affected all versions; fixed in 1.2.0\n- brotli (PyPI): affected all versions; fixed in 1.2.0\n- brotli (PyPI): affected all versions; fixed in 1.2.0\n- Scrapy (PyPI): affected all versions; fixed in 2.13.4\n- scrapy (PyPI): affected all versions; fixed in 2.13.4\n- scrapy (PyPI): affected all versions; fixed in 2.13.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-6176/ (Markdown: https://insights.sbomify.com/CVE-2025-6176/index.md)","id":"CVE-2025-6176","markdown":"https://insights.sbomify.com/CVE-2025-6176/index.md","name":"CVE-2025-6176","record":{"aliases":["ALSA-2026:0845","ALSA-2026:2042","ALSA-2026:2389","CLSA-2026-1770911059","CLSA-2026-1770911837","DEBIAN-CVE-2025-6176","ECHO-4052-5ae3-2f41","GHSA-2qfp-q593-8484","MINI-vv89-9r2q-x8f4","MINI-wf56-7pp6-3gfr","OESA-2025-2645","OESA-2025-2667","OESA-2025-2668","OESA-2025-2669","OESA-2025-2670","OESA-2025-2671","PYSEC-2026-1906","PYSEC-2026-2401","RHSA-2026:0008","RHSA-2026:0845","RHSA-2026:2042","RHSA-2026:2226","RHSA-2026:2227","RHSA-2026:2228","RHSA-2026:2229","RHSA-2026:2389","RHSA-2026:2399","RHSA-2026:2400","RHSA-2026:2401","RHSA-2026:2455","RLSA-2026:0845","RLSA-2026:2042","RLSA-2026:2389","ROOT-APP-PYPI-CVE-2025-6176","UBUNTU-CVE-2025-6176","openSUSE-SU-2025:15731-1","openSUSE-SU-2025:15732-1","openSUSE-SU-2026:10227-1"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Python web scraping library","requires_auth":"none","summary":"Remote servers can crash Scrapy clients via brotli decompression bombs, causing excessive memory consumption and denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"@huntr_ai","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.","ecosystems":["AlmaLinux:10","AlmaLinux:8","AlmaLinux:9","PyPI","Red Hat:enterprise_linux:10.1","Red Hat:enterprise_linux:8::appstream","Red Hat:enterprise_linux:8::baseos","Red Hat:enterprise_linux:9::appstream","Red Hat:enterprise_linux:9::baseos","Red Hat:enterprise_linux_eus:10.0","Red Hat:rhel_aus:8.2::baseos","Red Hat:rhel_aus:8.4::appstream","Red Hat:rhel_aus:8.4::baseos","Red Hat:rhel_aus:8.6::appstream","Red Hat:rhel_aus:8.6::baseos","Red Hat:rhel_e4s:8.6::appstream","Red Hat:rhel_e4s:8.6::baseos","Red Hat:rhel_e4s:8.8::appstream","Red Hat:rhel_e4s:8.8::baseos","Red Hat:rhel_e4s:9.0::appstream","Red Hat:rhel_e4s:9.0::baseos","Red Hat:rhel_e4s:9.2::appstream","Red Hat:rhel_e4s:9.2::baseos","Red Hat:rhel_eus:9.4::appstream","Red Hat:rhel_eus:9.4::baseos","Red Hat:rhel_eus:9.6::appstream","Red Hat:rhel_eus:9.6::baseos","Red Hat:rhel_eus_long_life:8.4::appstream","Red Hat:rhel_eus_long_life:8.4::baseos","Red Hat:rhel_tus:8.6::appstream","Red Hat:rhel_tus:8.6::baseos","Red Hat:rhel_tus:8.8::appstream","Red Hat:rhel_tus:8.8::baseos","Rocky Linux:10","Rocky Linux:8","Rocky Linux:9","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Brotli decompression bomb DoS in scrapy/scrapy","id":"CVE-2025-6176","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"denial_of_service","year":"2025"},"n_packages":180,"n_references":1,"next":{"headline":"ChromeOS MiniOS Root Code Execution Bypass While Dev Mode Blocked","id":"CVE-2025-6177"},"packages":[{"ecosystem":"PyPI","fixed":["2.13.4"],"introduced":["0"],"last_affected":[],"package":"Scrapy","purl":null,"source":"GHSA-2qfp-q593-8484"},{"ecosystem":"PyPI","fixed":["1.2.0"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":null,"source":"GHSA-2qfp-q593-8484"},{"ecosystem":"PyPI","fixed":["1.2.0"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:pypi/brotli","source":"GHSA-2qfp-q593-8484"},{"ecosystem":"PyPI","fixed":["1.2.0"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:pypi/brotli","source":"PYSEC-2026-2401"},{"ecosystem":"PyPI","fixed":["2.13.4"],"introduced":["0"],"last_affected":[],"package":"scrapy","purl":"pkg:pypi/scrapy","source":"GHSA-2qfp-q593-8484"},{"ecosystem":"PyPI","fixed":["2.13.4"],"introduced":["0"],"last_affected":[],"package":"scrapy","purl":"pkg:pypi/scrapy","source":"PYSEC-2026-1906"},{"ecosystem":"AlmaLinux:10","fixed":["1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/almalinux/brotli","source":"ALSA-2026:0845"},{"ecosystem":"AlmaLinux:10","fixed":["1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"brotli-devel","purl":"pkg:rpm/almalinux/brotli-devel","source":"ALSA-2026:0845"},{"ecosystem":"AlmaLinux:10","fixed":["1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"libbrotli","purl":"pkg:rpm/almalinux/libbrotli","source":"ALSA-2026:0845"},{"ecosystem":"AlmaLinux:10","fixed":["1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"python3-brotli","purl":"pkg:rpm/almalinux/python3-brotli","source":"ALSA-2026:0845"},{"ecosystem":"AlmaLinux:8","fixed":["1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/almalinux/brotli","source":"ALSA-2026:2389"},{"ecosystem":"AlmaLinux:8","fixed":["1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli-devel","purl":"pkg:rpm/almalinux/brotli-devel","source":"ALSA-2026:2389"},{"ecosystem":"AlmaLinux:8","fixed":["1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3-brotli","purl":"pkg:rpm/almalinux/python3-brotli","source":"ALSA-2026:2389"},{"ecosystem":"AlmaLinux:9","fixed":["1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/almalinux/brotli","source":"ALSA-2026:2042"},{"ecosystem":"AlmaLinux:9","fixed":["1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"brotli-devel","purl":"pkg:rpm/almalinux/brotli-devel","source":"ALSA-2026:2042"},{"ecosystem":"AlmaLinux:9","fixed":["1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"libbrotli","purl":"pkg:rpm/almalinux/libbrotli","source":"ALSA-2026:2042"},{"ecosystem":"AlmaLinux:9","fixed":["1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"python3-brotli","purl":"pkg:rpm/almalinux/python3-brotli","source":"ALSA-2026:2042"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/redhat/brotli","source":"RHSA-2026:0845"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"brotli-debuginfo","purl":"pkg:rpm/redhat/brotli-debuginfo","source":"RHSA-2026:0845"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"brotli-debugsource","purl":"pkg:rpm/redhat/brotli-debugsource","source":"RHSA-2026:0845"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"brotli-devel","purl":"pkg:rpm/redhat/brotli-devel","source":"RHSA-2026:0845"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"libbrotli","purl":"pkg:rpm/redhat/libbrotli","source":"RHSA-2026:0845"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"libbrotli-debuginfo","purl":"pkg:rpm/redhat/libbrotli-debuginfo","source":"RHSA-2026:0845"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"python3-brotli","purl":"pkg:rpm/redhat/python3-brotli","source":"RHSA-2026:0845"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:1.1.0-7.el10_1"],"introduced":["0"],"last_affected":[],"package":"python3-brotli-debuginfo","purl":"pkg:rpm/redhat/python3-brotli-debuginfo","source":"RHSA-2026:0845"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli-debuginfo","purl":"pkg:rpm/redhat/brotli-debuginfo","source":"RHSA-2026:2389"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli-debugsource","purl":"pkg:rpm/redhat/brotli-debugsource","source":"RHSA-2026:2389"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli-devel","purl":"pkg:rpm/redhat/brotli-devel","source":"RHSA-2026:2389"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3-brotli","purl":"pkg:rpm/redhat/python3-brotli","source":"RHSA-2026:2389"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3-brotli-debuginfo","purl":"pkg:rpm/redhat/python3-brotli-debuginfo","source":"RHSA-2026:2389"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/redhat/brotli","source":"RHSA-2026:2389"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli-debuginfo","purl":"pkg:rpm/redhat/brotli-debuginfo","source":"RHSA-2026:2389"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"brotli-debugsource","purl":"pkg:rpm/redhat/brotli-debugsource","source":"RHSA-2026:2389"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:1.0.6-4.el8_10"],"introduced":["0"],"last_affected":[],"package":"python3-brotli-debuginfo","purl":"pkg:rpm/redhat/python3-brotli-debuginfo","source":"RHSA-2026:2389"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["0:1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"brotli","purl":"pkg:rpm/redhat/brotli","source":"RHSA-2026:2042"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["0:1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"brotli-debuginfo","purl":"pkg:rpm/redhat/brotli-debuginfo","source":"RHSA-2026:2042"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["0:1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"brotli-debugsource","purl":"pkg:rpm/redhat/brotli-debugsource","source":"RHSA-2026:2042"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["0:1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"brotli-devel","purl":"pkg:rpm/redhat/brotli-devel","source":"RHSA-2026:2042"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["0:1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"libbrotli-debuginfo","purl":"pkg:rpm/redhat/libbrotli-debuginfo","source":"RHSA-2026:2042"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["0:1.0.9-9.el9_7"],"introduced":["0"],"last_affected":[],"package":"python3-brotli","purl":"pkg:rpm/redhat/python3-brotli","source":"RHSA-2026:2042"}],"prev":{"headline":"CRLF Injection in DECE Software's Geodi","id":"CVE-2025-6175"},"products":["scrapy/scrapy"],"published":"2025-10-31","related":[],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-10-31","vendors":["scrapy"]},"summary":"Remote servers can crash Scrapy clients via brotli decompression bombs, causing excessive memory consumption and denial of service.","url":"https://insights.sbomify.com/CVE-2025-6176/"}