https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:09:53.582138+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:0845 ALSA-2026:0845 — Important: brotli security update 2026-10-03T15:09:55.273053+00:00

Affected: AlmaLinux:10: brotli, AlmaLinux:10: brotli-devel, AlmaLinux:10: libbrotli, AlmaLinux:10: python3-brotli

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

* Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-00250 bdu:2026-00250 2026-10-03T15:09:55.273123+00:00 bdu:2026-00250 https://cve.radiocsirt.org/vuln/brew-aqtinstall-cve-2025-6176 BREW-aqtinstall-CVE-2025-6176 — Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation 2026-10-03T15:09:55.273141+00:00

Affected: Homebrew: aqtinstall

Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. Mitigation for this vulnerability needs security enhancement added in brotli v1.2.0.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0218 certfr-2026-avi-0218 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq… 2026-10-03T15:09:55.273166+00:00 certfr-2026-avi-0218 https://cve.radiocsirt.org/vuln/euvd-2026-257345 EUVD-2026-257345 2026-10-03T15:09:55.273183+00:00 EUVD-2026-257345 https://cve.radiocsirt.org/vuln/fkie_cve-2025-6176 fkie_cve-2025-6176 2026-10-03T15:09:55.273195+00:00

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

 https://cve.radiocsirt.org/vuln/ghsa-2qfp-q593-8484 GHSA-2qfp-q593-8484 — Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation 2026-10-03T15:09:55.273219+00:00

Affected: PyPI: brotli, PyPI: Scrapy

Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. Mitigation for this vulnerability needs security enhancement added in brotli v1.2.0.

 https://cve.radiocsirt.org/vuln/oesa-2025-2645 OESA-2025-2645 — brotli security update 2026-10-03T15:09:55.273243+00:00

Affected: openEuler:24.03-LTS-SP1: brotli

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. Security Fix(es):

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.(CVE-2025-6176)

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15731-1 openSUSE-SU-2025:15731-1 — python311-Brotli-1.2.0-1.1 on GA media 2026-10-03T15:09:55.273268+00:00

python311-Brotli-1.2.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-1906 PYSEC-2026-1906 — Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation 2026-10-03T15:09:55.273286+00:00

Affected: PyPI: scrapy

Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. Mitigation for this vulnerability needs security enhancement added in brotli v1.2.0.

 https://cve.radiocsirt.org/vuln/rhsa-2026:0008 RHSA-2026:0008 — Red Hat Security Advisory: brotli security update 2026-10-03T15:09:55.273306+00:00

Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-6176 UBUNTU-CVE-2025-6176 2026-10-03T15:09:55.273322+00:00

Affected: Ubuntu:16.04:LTS: python-scrapy, Ubuntu:Pro:18.04:LTS: python-scrapy, Ubuntu:Pro:20.04:LTS: python-scrapy, Ubuntu:Pro:22.04:LTS: python-scrapy, Ubuntu:Pro:24.04:LTS: python-scrapy, Ubuntu:25.10: python-scrapy, Ubuntu:26.04:LTS: python-scrapy

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0008 WID-SEC-W-2026-0008 — Red Hat Enterprise Linux: Mehrere Schwachstellen 2026-10-03T15:09:55.273350+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux bezüglich der Komponenten "tar" und "Scrapy" ausnutzen, um Dateien zu manipulieren, und um einen Denial of Service Angriff durchzuführen.