GHSA-2qfp-q593-8484

Source

https://github.com/advisories/GHSA-2qfp-q593-8484

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-2qfp-q593-8484/GHSA-2qfp-q593-8484.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2qfp-q593-8484

Aliases

CVE-2025-6176

Related

CGA-f292-96m2-9hrc

Published

2025-10-31T00:30:35Z

Modified

2025-11-07T19:18:36.359448Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Scrapy with Brotli is vulnerable to a denial of service (DoS) attack due to decompression

Details

Brotli versions up to 1.1.0 are vulnerable to a denial of service (DoS) attack due to decompression. This issue has been patched in Brotli version 1.2.0.

Additionally, this affects users who implement the Brotli decompression with Scrapy versions up to 2.13.2, leaving them vulnerable to a denial of service (DoS) attack. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

Database specific

{
    "github_reviewed": true,
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-400"
    ],
    "nvd_published_at": "2025-10-31T00:15:37Z",
    "github_reviewed_at": "2025-10-31T21:23:47Z"
}

References

Affected packages

PyPI / brotli

Package

Name: brotli; View open source insights on deps.dev
Purl: pkg:pypi/brotli

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.0

Affected versions

0.*

0.5.2

0.6.0

1.*

1.0.1

1.0.4

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0

Database specific

last_known_affected_version_range

"<= 1.1.0"

PyPI / scrapy

Package

Name: scrapy; View open source insights on deps.dev
Purl: pkg:pypi/scrapy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.13.3

Affected versions

0.*

0.7

0.8

0.9

0.10.4.2364

0.12.0.2550

0.14.1

0.14.2

0.14.3

0.14.4

0.16.0

0.16.1

0.16.2

0.16.3

0.16.4

0.16.5

0.18.0

0.18.1

0.18.2

0.18.3

0.18.4

0.20.0

0.20.1

0.20.2

0.22.0

0.22.1

0.22.2

0.24.0

0.24.1

0.24.2

0.24.3

0.24.4

0.24.5

0.24.6

1.*

1.0.0rc1

1.0.0rc2

1.0.0rc3

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.1.0rc1

1.1.0rc2

1.1.0rc3

1.1.0rc4

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0

1.3.1

1.3.2

1.3.3

1.4.0

1.5.0

1.5.1

1.5.2

1.6.0

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

2.*

2.0.0

2.0.1

2.1.0

2.2.0

2.2.1

2.3.0

2.4.0

2.4.1

2.5.0

2.5.1

2.6.0

2.6.1

2.6.2

2.6.3

2.7.0

2.7.1

2.8.0

2.9.0

2.10.0

2.10.1

2.11.0

2.11.1

2.11.2

2.12.0

2.13.0

2.13.1

2.13.2

2.13.3