Most recent entries from all

ALSA-2026:0845 — Important: brotli security update

Affected: AlmaLinux:10: brotli, AlmaLinux:10: brotli-devel, AlmaLinux:10: libbrotli, AlmaLinux:10: python3-brotli

Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.

Security Fix(es):

* Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-00250

BREW-aqtinstall-CVE-2025-6176 — Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Affected: Homebrew: aqtinstall

Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. Mitigation for this vulnerability needs security enhancement added in brotli v1.2.0.

certfr-2026-avi-0218 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2026-avi-0218

EUVD-2026-257345

fkie_cve-2025-6176

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

GHSA-2qfp-q593-8484 — Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Affected: PyPI: brotli, PyPI: Scrapy

OESA-2025-2645 — brotli security update

Affected: openEuler:24.03-LTS-SP1: brotli

openSUSE-SU-2025:15731-1 — python311-Brotli-1.2.0-1.1 on GA media

python311-Brotli-1.2.0-1.1 on GA media

PYSEC-2026-1906 — Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Affected: PyPI: scrapy

RHSA-2026:0008 — Red Hat Security Advisory: brotli security update

Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS

UBUNTU-CVE-2025-6176

Affected: Ubuntu:16.04:LTS: python-scrapy, Ubuntu:Pro:18.04:LTS: python-scrapy, Ubuntu:Pro:20.04:LTS: python-scrapy, Ubuntu:Pro:22.04:LTS: python-scrapy, Ubuntu:Pro:24.04:LTS: python-scrapy, Ubuntu:25.10: python-scrapy, Ubuntu:26.04:LTS: python-scrapy

WID-SEC-W-2026-0008 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux bezüglich der Komponenten "tar" und "Scrapy" ausnutzen, um Dateien zu manipulieren, und um einen Denial of Service Angriff durchzuführen.