CVE-2025-6176 - CVE House
Back to Database
Status published High CVE-2025-6176

Brotli decompression bomb DoS in scrapy/scrapy

Vulnerability Description

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6176

Credits & Attribution

No credits recorded in the NVD database.

References

More from scrapy

View All →
CVE-2024-3574
Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy
High 7.5
CVE-2024-3572
XML External Entity (XXE) Vulnerability in scrapy/scrapy
High 7.5
CVE-2024-1968
Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects
High 7.5
CVE-2024-1892
ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider
High 7.5
CVE-2022-0577
Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy
High 8.8

Affected Vendor

Affected Software

scrapy/scrapy
Vulnerable Versions:
unspecified

Timeline

Official Publish: October 31st, 2025
Last Modified: October 31st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact