CVE-2024-1892: high-severity vulnerability in scrapy/scrapy
ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.6%
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
scrapy · scrapy/scrapyRelated CVEs — scrapy/scrapy
In the same product, most dangerous first.
CVE-2022-0577HIGHExposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapyEPSS 1.2%CVE-2024-3572HIGHXML External Entity (XXE) Vulnerability in scrapy/scrapyEPSS 0.8%CVE-2024-1968HIGHAuthorization Header Leakage in scrapy/scrapy on Scheme Change RedirectsEPSS 0.7%CVE-2024-3574HIGHAuthorization Header Leak During Cross-Domain Redirect in scrapy/scrapyEPSS 0.6%CVE-2025-6176HIGHBrotli decompression bomb DoS in scrapy/scrapyEPSS 0.5%