--- id: CVE-2025-6176 title: >- Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176) summary: >- Scrapy are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-400 vendor: Red Hat product: Red Hat Satellite 6.17 for RHEL 9 affected: - ansible_automation_platform 2 - ceph_storage 8 - satellite 6 - openshift_container_platform 4.12 - satellite_6_16_for_rhel 8 - openshift_container_platform 4.13 - openshift_container_platform 4.14 - openshift_container_platform 4.15 - openshift_container_platform 4.16 - openshift_container_platform 4.17 - openshift_container_platform 4.18 - openshift_container_platform 4.19 - satellite_6_16_for_rhel 9 - satellite_6_17_for_rhel 9 - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_eus_extension_v_8_4 - enterprise_linux_appstream_aus_v_8_6 - enterprise_linux_appstream_e4s_v_8_6 - enterprise_linux_appstream_tus_v_8_6 - enterprise_linux_appstream_e4s_v_8_8 - enterprise_linux_appstream_tus_v_8_8 - enterprise_linux_appstream_e4s_v_9_0 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_eus_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_2 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_e4s_v_8_6 - enterprise_linux_baseos_tus_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 patched: - openshift_container_platform 4.12 - satellite_6_16_for_rhel 8 - openshift_container_platform 4.13 - openshift_container_platform 4.14 - openshift_container_platform 4.15 - openshift_container_platform 4.16 - openshift_container_platform 4.17 - openshift_container_platform 4.18 - openshift_container_platform 4.19 - satellite_6_16_for_rhel 9 - satellite_6_17_for_rhel 9 - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_eus_extension_v_8_4 - enterprise_linux_appstream_aus_v_8_6 - enterprise_linux_appstream_e4s_v_8_6 - enterprise_linux_appstream_tus_v_8_6 - enterprise_linux_appstream_e4s_v_8_8 - enterprise_linux_appstream_tus_v_8_8 - enterprise_linux_appstream_e4s_v_9_0 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_eus_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_2 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_e4s_v_8_6 - enterprise_linux_baseos_tus_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_baseos_e4s_v_9_0 - enterprise_linux_baseos_e4s_v_9_2 - enterprise_linux_baseos_eus_v_9_4 published: '2025-10-31' updated: '2026-10-09' sourceUpdated: '2026-10-09T01:05:56+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6176.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6176.json - url: 'https://access.redhat.com/security/cve/CVE-2025-6176' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2408762' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-6176' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6176' - url: 'https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0' - url: 'https://access.redhat.com/errata/RHSA-2026:3861' - url: 'https://access.redhat.com/errata/RHSA-2026:5971' - url: 'https://access.redhat.com/errata/RHSA-2026:3415' - url: 'https://access.redhat.com/errata/RHSA-2026:2974' - url: 'https://access.redhat.com/errata/RHSA-2026:4419' - url: 'https://access.redhat.com/errata/RHSA-2026:4465' - url: 'https://access.redhat.com/errata/RHSA-2026:3417' - url: 'https://access.redhat.com/errata/RHSA-2026:2976' - url: 'https://access.redhat.com/errata/RHSA-2026:3392' - url: 'https://access.redhat.com/errata/RHSA-2026:5970' - url: 'https://access.redhat.com/errata/RHSA-2026:0008' - url: 'https://access.redhat.com/errata/RHSA-2026:0845' - url: 'https://access.redhat.com/errata/RHSA-2026:2389' - url: 'https://access.redhat.com/errata/RHSA-2026:2399' - url: 'https://access.redhat.com/errata/RHSA-2026:2455' - url: 'https://access.redhat.com/errata/RHSA-2026:2400' - url: 'https://access.redhat.com/errata/RHSA-2026:2226' - url: 'https://access.redhat.com/errata/RHSA-2026:2228' - url: 'https://access.redhat.com/errata/RHSA-2026:2227' - url: 'https://access.redhat.com/errata/RHSA-2026:2229' - url: 'https://access.redhat.com/errata/RHSA-2026:2042' - url: 'https://access.redhat.com/errata/RHSA-2026:2401' - url: 'https://access.redhat.com/errata/RHSA-2026:2800' - url: 'https://access.redhat.com/errata/RHSA-2026:2737' - url: 'https://github.com/google/brotli/issues/1327' - url: 'https://github.com/google/brotli/issues/1375' - url: 'https://github.com/google/brotli/pull/1234' - url: 'https://github.com/scrapy/scrapy/pull/7134' - url: >- https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627 - url: >- https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da - url: 'https://github.com/google/brotli' - url: 'https://github.com/google/brotli/releases/tag/v1.2.0' tags: - csaf - vex - red-hat - osv - pip epss: 0.00545 epssPercentile: 0.45511 aliases: - GHSA-2qfp-q593-8484 - PYSEC-2026-1906 - PYSEC-2026-2401 ecosystem: pip ingestedAt: '2026-07-08T18:25:44.599Z' --- ## Overview Scrapy are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. ## Vendor advisories - **RHSA-2026:3861** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-03-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:3861) - **RHSA-2026:5971** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-03-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:5971) - **RHSA-2026:3415** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:3415) - **RHSA-2026:2974** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-02-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:2974) - **RHSA-2026:4419** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-03-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:4419) - **RHSA-2026:4465** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-03-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:4465) - **RHSA-2026:3417** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3417) - **RHSA-2026:2976** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-02-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:2976) - **RHSA-2026:3392** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3392) - **RHSA-2026:5970** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-03-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:5970) - **RHSA-2026:0008** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-01-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:0008) - **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Ceph Storage 8, Red Hat Satellite 6 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Ceph Storage 8, Red Hat Satellite 6 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6176.json) **Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS** — rated Important by Red Hat. Released 2025-10-31, updated 2026-10-09. Affected: - Red Hat Ansible Automation Platform 2 - Red Hat Ceph Storage 8 - Red Hat Satellite 6 Fixed: - Red Hat OpenShift Container Platform 4.12 - Red Hat Satellite 6.16 for RHEL 8 - Red Hat OpenShift Container Platform 4.13 - Red Hat OpenShift Container Platform 4.14 - Red Hat OpenShift Container Platform 4.15 - Red Hat OpenShift Container Platform 4.16 - Red Hat OpenShift Container Platform 4.17 - Red Hat OpenShift Container Platform 4.18 - Red Hat OpenShift Container Platform 4.19 - Red Hat Satellite 6.16 for RHEL 9 - Red Hat Satellite 6.17 for RHEL 9 - Red Hat Enterprise Linux AppStream EUS (v. 10.0) - Red Hat Enterprise Linux AppStream (v. 10) - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream AUS (v.8.4) - Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) - Red Hat Enterprise Linux AppStream AUS (v.8.6) - Red Hat Enterprise Linux AppStream E4S (v.8.6) - Red Hat Enterprise Linux AppStream TUS (v.8.6) - Red Hat Enterprise Linux AppStream E4S (v.8.8) - Red Hat Enterprise Linux AppStream TUS (v.8.8) - Red Hat Enterprise Linux AppStream E4S (v.9.0) - Red Hat Enterprise Linux AppStream E4S (v.9.2) - Red Hat Enterprise Linux AppStream EUS (v.9.4) - Red Hat Enterprise Linux AppStream EUS (v.9.6) - Red Hat Enterprise Linux AppStream (v. 9) - Red Hat Enterprise Linux BaseOS EUS (v. 10.0) - Red Hat Enterprise Linux BaseOS (v. 10) - Red Hat Enterprise Linux BaseOS (v. 8) - Red Hat Enterprise Linux BaseOS AUS (v. 8.2) - Red Hat Enterprise Linux BaseOS AUS (v.8.4) - Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) - Red Hat Enterprise Linux BaseOS AUS (v.8.6) - Red Hat Enterprise Linux BaseOS E4S (v.8.6) - Red Hat Enterprise Linux BaseOS TUS (v.8.6) - Red Hat Enterprise Linux BaseOS E4S (v.8.8) - Red Hat Enterprise Linux BaseOS TUS (v.8.8) - Red Hat Enterprise Linux BaseOS E4S (v.9.0) - Red Hat Enterprise Linux BaseOS E4S (v.9.2) - Red Hat Enterprise Linux BaseOS EUS (v.9.4) No fix planned: - Red Hat Ansible Automation Platform 2 - Red Hat Ceph Storage 8 - Red Hat Satellite 6 Not affected: - Red Hat Satellite 6.16 for RHEL 8 - Red Hat Satellite 6.16 for RHEL 9 - Red Hat Ceph Storage 7 - Red Hat Ceph Storage 8 - Red Hat Ceph Storage 9 - Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 - Red Hat Ansible Automation Platform 2 - Red Hat JBoss Core Services - Red Hat Satellite 6 - Red Hat Update Infrastructure 4 for Cloud Providers ## Remediation For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 arc… https://access.redhat.com/errata/RHSA-2026:3861 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:5971 For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 arc… https://access.redhat.com/errata/RHSA-2026:3415 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. ## Package advisory (CVE-2025-6176) Affected packages: - `brotli < 1.2.0` - `scrapy < 2.13.4` Patched in: - `brotli 1.2.0` - `scrapy 2.13.4` Source: https://osv.dev/vulnerability/GHSA-2qfp-q593-8484