# CVE-2025-6176: Brotli decompression bomb DoS in scrapy/scrapy > Remote servers can crash Scrapy clients via brotli decompression bombs, causing excessive memory consumption and denial of service. - **Severity:** High 7.5 (`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 31 Oct 2025 - **Updated:** 31 Oct 2025 - **Also known as:** ALSA-2026:0845, ALSA-2026:2042, ALSA-2026:2389, CLSA-2026-1770911059, CLSA-2026-1770911837, DEBIAN-CVE-2025-6176, ECHO-4052-5ae3-2f41, GHSA-2qfp-q593-8484, MINI-vv89-9r2q-x8f4, MINI-wf56-7pp6-3gfr, OESA-2025-2645, OESA-2025-2667, OESA-2025-2668, OESA-2025-2669, OESA-2025-2670, OESA-2025-2671, PYSEC-2026-1906, PYSEC-2026-2401, RHSA-2026:0008, RHSA-2026:0845, RHSA-2026:2042, RHSA-2026:2226, RHSA-2026:2227, RHSA-2026:2228, RHSA-2026:2229, RHSA-2026:2389, RHSA-2026:2399, RHSA-2026:2400, RHSA-2026:2401, RHSA-2026:2455, RLSA-2026:0845, RLSA-2026:2042, RLSA-2026:2389, ROOT-APP-PYPI-CVE-2025-6176, UBUNTU-CVE-2025-6176, openSUSE-SU-2025:15731-1, openSUSE-SU-2025:15732-1, openSUSE-SU-2026:10227-1 ## What is CVE-2025-6176? CVE-2025-6176 is a high-severity denial of service vulnerability in scrapy/scrapy, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. Weakness: CWE-400 (Uncontrolled Resource Consumption) ## Which versions are affected by CVE-2025-6176? 6 open source packages ship an affected version, including brotli, Scrapy and scrapy. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `brotli` | PyPI | All versions | 1.2.0 | | `brotli` | PyPI | All versions | 1.2.0 | | `brotli` | PyPI | All versions | 1.2.0 | | `Scrapy` | PyPI | All versions | 2.13.4 | | `scrapy` | PyPI | All versions | 2.13.4 | | `scrapy` | PyPI | All versions | 2.13.4 | | `brotli` | AlmaLinux:10 | All versions | 1.1.0-7.el10_1 | | `brotli-devel` | AlmaLinux:10 | All versions | 1.1.0-7.el10_1 | | `libbrotli` | AlmaLinux:10 | All versions | 1.1.0-7.el10_1 | | `python3-brotli` | AlmaLinux:10 | All versions | 1.1.0-7.el10_1 | | `brotli` | AlmaLinux:8 | All versions | 1.0.6-4.el8_10 | | `brotli-devel` | AlmaLinux:8 | All versions | 1.0.6-4.el8_10 | | `python3-brotli` | AlmaLinux:8 | All versions | 1.0.6-4.el8_10 | | `brotli` | AlmaLinux:9 | All versions | 1.0.9-9.el9_7 | | `brotli-devel` | AlmaLinux:9 | All versions | 1.0.9-9.el9_7 | | `libbrotli` | AlmaLinux:9 | All versions | 1.0.9-9.el9_7 | | `python3-brotli` | AlmaLinux:9 | All versions | 1.0.9-9.el9_7 | | `brotli` | Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 | | `brotli-debuginfo` | Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 | | `brotli-debugsource` | Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 | | `brotli-devel` | Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 | | `libbrotli` | Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 | | `libbrotli-debuginfo` | Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 | | `python3-brotli` | Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 | | `python3-brotli-debuginfo` | Red Hat:enterprise_linux:10.1 | All versions | 0:1.1.0-7.el10_1 | | `brotli-debuginfo` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 | | `brotli-debugsource` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 | | `brotli-devel` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 | | `python3-brotli` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 | | `python3-brotli-debuginfo` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-4.el8_10 | | `brotli` | Red Hat:enterprise_linux:8::baseos | All versions | 0:1.0.6-4.el8_10 | | `brotli-debuginfo` | Red Hat:enterprise_linux:8::baseos | All versions | 0:1.0.6-4.el8_10 | | `brotli-debugsource` | Red Hat:enterprise_linux:8::baseos | All versions | 0:1.0.6-4.el8_10 | | `python3-brotli-debuginfo` | Red Hat:enterprise_linux:8::baseos | All versions | 0:1.0.6-4.el8_10 | | `brotli` | Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 | | `brotli-debuginfo` | Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 | | `brotli-debugsource` | Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 | | `brotli-devel` | Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 | | `libbrotli-debuginfo` | Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 | | `python3-brotli` | Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.9-9.el9_7 | ## How do I fix CVE-2025-6176? Upgrade brotli to 1.2.0 or later. ## Is CVE-2025-6176 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6176 exists. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2025-6176 and fix it if it is affected. What it is: CVE-2025-6176 is a high-severity denial of service vulnerability in scrapy/scrapy, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6176 exists. Affected packages and fixed versions: - brotli (PyPI): affected all versions; fixed in 1.2.0 - brotli (PyPI): affected all versions; fixed in 1.2.0 - brotli (PyPI): affected all versions; fixed in 1.2.0 - Scrapy (PyPI): affected all versions; fixed in 2.13.4 - scrapy (PyPI): affected all versions; fixed in 2.13.4 - scrapy (PyPI): affected all versions; fixed in 2.13.4 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2025-6176/ (Markdown: https://insights.sbomify.com/CVE-2025-6176/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-6176 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-6176 - OSV: https://osv.dev/vulnerability/CVE-2025-6176 --- From sbomify Insights: https://insights.sbomify.com/CVE-2025-6176/ Summaries are generated and may contain mistakes; the official description above is the record.