CVE-2025-6176highCWE-400

CVE-2025-6176: fallo de gravedad alta en scrapy/scrapy

Brotli decompression bomb DoS in scrapy/scrapy

Publicada el

Seguir esta CVE+ Monitorear scrapy/scrapy+ Monitorear python-scrapy

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.5%
Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
scrapy · scrapy/scrapy
CVEs relacionadas — scrapy/scrapy

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-0577HIGHExposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapyEPSS 1.2%CVE-2024-3572HIGHXML External Entity (XXE) Vulnerability in scrapy/scrapyEPSS 0.8%CVE-2024-1968HIGHAuthorization Header Leakage in scrapy/scrapy on Scheme Change RedirectsEPSS 0.7%CVE-2024-3574HIGHAuthorization Header Leak During Cross-Domain Redirect in scrapy/scrapyEPSS 0.6%CVE-2024-1892HIGHReDoS Vulnerability in scrapy/scrapy's XMLFeedSpiderEPSS 0.6%