{"id":"CVE-2025-6176","title":"Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176)","summary":"Scrapy are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-400","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","affected":["ansible_automation_platform 2","ceph_storage 8","satellite 6","openshift_container_platform 4.12","satellite_6_16_for_rhel 8","openshift_container_platform 4.13","openshift_container_platform 4.14","openshift_container_platform 4.15","openshift_container_platform 4.16","openshift_container_platform 4.17","openshift_container_platform 4.18","openshift_container_platform 4.19","satellite_6_16_for_rhel 9","satellite_6_17_for_rhel 9","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_eus_extension_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_e4s_v_8_6","enterprise_linux_appstream_tus_v_8_6","enterprise_linux_appstream_e4s_v_8_8","enterprise_linux_appstream_tus_v_8_8","enterprise_linux_appstream_e4s_v_9_0","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_2","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_e4s_v_8_6","enterprise_linux_baseos_tus_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8"],"patched":["openshift_container_platform 4.12","satellite_6_16_for_rhel 8","openshift_container_platform 4.13","openshift_container_platform 4.14","openshift_container_platform 4.15","openshift_container_platform 4.16","openshift_container_platform 4.17","openshift_container_platform 4.18","openshift_container_platform 4.19","satellite_6_16_for_rhel 9","satellite_6_17_for_rhel 9","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_eus_extension_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_e4s_v_8_6","enterprise_linux_appstream_tus_v_8_6","enterprise_linux_appstream_e4s_v_8_8","enterprise_linux_appstream_tus_v_8_8","enterprise_linux_appstream_e4s_v_9_0","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_2","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_e4s_v_8_6","enterprise_linux_baseos_tus_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_0","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_eus_v_9_4"],"published":"2025-10-31","updated":"2026-10-09","sourceUpdated":"2026-10-09T01:05:56+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6176.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6176.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-6176"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2408762"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-6176"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6176"},{"url":"https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0"},{"url":"https://access.redhat.com/errata/RHSA-2026:3861"},{"url":"https://access.redhat.com/errata/RHSA-2026:5971"},{"url":"https://access.redhat.com/errata/RHSA-2026:3415"},{"url":"https://access.redhat.com/errata/RHSA-2026:2974"},{"url":"https://access.redhat.com/errata/RHSA-2026:4419"},{"url":"https://access.redhat.com/errata/RHSA-2026:4465"},{"url":"https://access.redhat.com/errata/RHSA-2026:3417"},{"url":"https://access.redhat.com/errata/RHSA-2026:2976"},{"url":"https://access.redhat.com/errata/RHSA-2026:3392"},{"url":"https://access.redhat.com/errata/RHSA-2026:5970"},{"url":"https://access.redhat.com/errata/RHSA-2026:0008"},{"url":"https://access.redhat.com/errata/RHSA-2026:0845"},{"url":"https://access.redhat.com/errata/RHSA-2026:2389"},{"url":"https://access.redhat.com/errata/RHSA-2026:2399"},{"url":"https://access.redhat.com/errata/RHSA-2026:2455"},{"url":"https://access.redhat.com/errata/RHSA-2026:2400"},{"url":"https://access.redhat.com/errata/RHSA-2026:2226"},{"url":"https://access.redhat.com/errata/RHSA-2026:2228"},{"url":"https://access.redhat.com/errata/RHSA-2026:2227"},{"url":"https://access.redhat.com/errata/RHSA-2026:2229"},{"url":"https://access.redhat.com/errata/RHSA-2026:2042"},{"url":"https://access.redhat.com/errata/RHSA-2026:2401"},{"url":"https://access.redhat.com/errata/RHSA-2026:2800"},{"url":"https://access.redhat.com/errata/RHSA-2026:2737"},{"url":"https://github.com/google/brotli/issues/1327"},{"url":"https://github.com/google/brotli/issues/1375"},{"url":"https://github.com/google/brotli/pull/1234"},{"url":"https://github.com/scrapy/scrapy/pull/7134"},{"url":"https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627"},{"url":"https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da"},{"url":"https://github.com/google/brotli"},{"url":"https://github.com/google/brotli/releases/tag/v1.2.0"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00545,"epssPercentile":0.45511,"aliases":["GHSA-2qfp-q593-8484","PYSEC-2026-1906","PYSEC-2026-2401"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:44.599Z","slug":"CVE-2025-6176","body":"## Overview\n\nScrapy are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.\n\n## Vendor advisories\n\n- **RHSA-2026:3861** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-03-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:3861)\n- **RHSA-2026:5971** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-03-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:5971)\n- **RHSA-2026:3415** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:3415)\n- **RHSA-2026:2974** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-02-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:2974)\n- **RHSA-2026:4419** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-03-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:4419)\n- **RHSA-2026:4465** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-03-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:4465)\n- **RHSA-2026:3417** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3417)\n- **RHSA-2026:2976** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-02-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:2976)\n- **RHSA-2026:3392** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3392)\n- **RHSA-2026:5970** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-03-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:5970)\n- **RHSA-2026:0008** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0008)\n- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Ceph Storage 8, Red Hat Satellite 6 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Ceph Storage 8, Red Hat Satellite 6 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6176.json)\n\n**Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS** — rated Important by Red Hat. Released 2025-10-31, updated 2026-10-09.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 8\n- Red Hat Satellite 6\n\nFixed:\n\n- Red Hat OpenShift Container Platform 4.12\n- Red Hat Satellite 6.16 for RHEL 8\n- Red Hat OpenShift Container Platform 4.13\n- Red Hat OpenShift Container Platform 4.14\n- Red Hat OpenShift Container Platform 4.15\n- Red Hat OpenShift Container Platform 4.16\n- Red Hat OpenShift Container Platform 4.17\n- Red Hat OpenShift Container Platform 4.18\n- Red Hat OpenShift Container Platform 4.19\n- Red Hat Satellite 6.16 for RHEL 9\n- Red Hat Satellite 6.17 for RHEL 9\n- Red Hat Enterprise Linux AppStream EUS (v. 10.0)\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream AUS (v.8.4)\n- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\n- Red Hat Enterprise Linux AppStream AUS (v.8.6)\n- Red Hat Enterprise Linux AppStream E4S (v.8.6)\n- Red Hat Enterprise Linux AppStream TUS (v.8.6)\n- Red Hat Enterprise Linux AppStream E4S (v.8.8)\n- Red Hat Enterprise Linux AppStream TUS (v.8.8)\n- Red Hat Enterprise Linux AppStream E4S (v.9.0)\n- Red Hat Enterprise Linux AppStream E4S (v.9.2)\n- Red Hat Enterprise Linux AppStream EUS (v.9.4)\n- Red Hat Enterprise Linux AppStream EUS (v.9.6)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat Enterprise Linux BaseOS EUS (v. 10.0)\n- Red Hat Enterprise Linux BaseOS (v. 10)\n- Red Hat Enterprise Linux BaseOS (v. 8)\n- Red Hat Enterprise Linux BaseOS AUS (v. 8.2)\n- Red Hat Enterprise Linux BaseOS AUS (v.8.4)\n- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)\n- Red Hat Enterprise Linux BaseOS AUS (v.8.6)\n- Red Hat Enterprise Linux BaseOS E4S (v.8.6)\n- Red Hat Enterprise Linux BaseOS TUS (v.8.6)\n- Red Hat Enterprise Linux BaseOS E4S (v.8.8)\n- Red Hat Enterprise Linux BaseOS TUS (v.8.8)\n- Red Hat Enterprise Linux BaseOS E4S (v.9.0)\n- Red Hat Enterprise Linux BaseOS E4S (v.9.2)\n- Red Hat Enterprise Linux BaseOS EUS (v.9.4)\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 8\n- Red Hat Satellite 6\n\nNot affected:\n\n- Red Hat Satellite 6.16 for RHEL 8\n- Red Hat Satellite 6.16 for RHEL 9\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat OpenShift Dev Spaces (RHOSDS) 3.26\n- Red Hat Ansible Automation Platform 2\n- Red Hat JBoss Core Services\n- Red Hat Satellite 6\n- Red Hat Update Infrastructure 4 for Cloud Providers\n\n## Remediation\n\nFor OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 arc… https://access.redhat.com/errata/RHSA-2026:3861\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:5971\nFor OpenShift Container Platform 4.13 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 arc… https://access.redhat.com/errata/RHSA-2026:3415\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2025-6176)\n\nAffected packages:\n\n- `brotli < 1.2.0`\n- `scrapy < 2.13.4`\n\nPatched in:\n\n- `brotli 1.2.0`\n- `scrapy 2.13.4`\n\nSource: https://osv.dev/vulnerability/GHSA-2qfp-q593-8484","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}