7.5

CVE-2025-6176: scrapy scrapy/scrapy Uncontrolled Resource Consumption

CVSS: 7.5v3.0HighDeferred
AliasesGHSA-2qfp-q593-8484PYSEC-2026-1906PYSEC-2026-2401
Published 31-10-2025Last modified 31-10-2025
Open JSON

Vulnerability summary

CVE-2025-6176 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in scrapy scrapy/scrapy. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.5% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (CVE.org)
EPSS score
0.55%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
RHSA-2026:5970RHSA-2026:5971CGA-F292-96M2-9HRCCGA-H529-4C93-P7PH

Timeline

  1. 31-10-2025
    PublishedVulnerability first disclosed.
  2. 31-10-2025
    Last modifiedVulnerability information updated.

Description

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

CVSS metrics

8 scores · 8 sources · 2 versions

EPSS trend

Probability

0.55%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

+0.04 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.55%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard9 products
  • mitmproxy< 12.2.1-r0
  • nemo< 2.5.2-r2
  • open-webuiAll versions (No fix recorded)
  • open-webui-compatAll versions (No fix recorded)
  • pgadmin4< 9.9-r1
Redhat8 products
  • brotli< 0:1.1.0-7.el10_1 | < 0:1.0.9-9.el9_7 | < 0:1.0.9-6.el9_0.1 | < 0:1.0.9-6.el9_4.1 | < 0:1.0.9-6.el9_2.1 | < 0:1.0.9-7.el9_6.1 | < 0:1.0.6-4.el8_10 | < 0:1.0.6-4.el8_4 | < 0:1.0.6-4.el8_8 | < 0:1.0.6-1.el8_2.1 | < 0:1.0.6-4.el8_6 | < 0:1.1.0-6.el10_0.1
  • brotli-debuginfo< 0:1.1.0-7.el10_1 | < 0:1.0.9-9.el9_7 | < 0:1.0.9-6.el9_0.1 | < 0:1.0.9-6.el9_4.1 | < 0:1.0.9-6.el9_2.1 | < 0:1.0.9-7.el9_6.1 | < 0:1.0.6-4.el8_10 | < 0:1.0.6-4.el8_4 | < 0:1.0.6-4.el8_8 | < 0:1.0.6-1.el8_2.1 | < 0:1.0.6-4.el8_6 | < 0:1.1.0-6.el10_0.1
  • brotli-debugsource< 0:1.1.0-7.el10_1 | < 0:1.0.9-9.el9_7 | < 0:1.0.9-6.el9_0.1 | < 0:1.0.9-6.el9_4.1 | < 0:1.0.9-6.el9_2.1 | < 0:1.0.9-7.el9_6.1 | < 0:1.0.6-4.el8_10 | < 0:1.0.6-4.el8_4 | < 0:1.0.6-4.el8_8 | < 0:1.0.6-1.el8_2.1 | < 0:1.0.6-4.el8_6 | < 0:1.1.0-6.el10_0.1
  • brotli-devel< 0:1.1.0-7.el10_1 | < 0:1.0.9-9.el9_7 | < 0:1.0.9-6.el9_0.1 | < 0:1.0.9-6.el9_4.1 | < 0:1.0.9-6.el9_2.1 | < 0:1.0.9-7.el9_6.1 | < 0:1.0.6-4.el8_10 | < 0:1.0.6-4.el8_4 | < 0:1.0.6-4.el8_8 | < 0:1.0.6-4.el8_6 | < 0:1.1.0-6.el10_0.1
  • libbrotli< 0:1.1.0-7.el10_1 | < 0:1.0.9-9.el9_7 | < 0:1.0.9-6.el9_0.1 | < 0:1.0.9-6.el9_4.1 | < 0:1.0.9-6.el9_2.1 | < 0:1.0.9-7.el9_6.1 | < 0:1.1.0-6.el10_0.1
Opensuse3 products
  • python-Brotli&distro=openSUSE Tumbleweed< 1.2.0-1.1
  • python-py7zr&distro=openSUSE Tumbleweed< 1.1.0-1.1
  • python-Scrapy&distro=openSUSE Tumbleweed< 2.13.3-2.1
Wolfi3 products
  • mitmproxy< 12.2.1-r0
  • open-webuiAll versions (No fix recorded)
  • open-webui-compatAll versions (No fix recorded)
PyPI2 products
  • brotli< 1.2.0
  • scrapy< 2.13.4
Debian1 product
  • python-scrapyAll versions (No fix recorded) | < 2.13.4-1
Scrapy1 product
Ubuntu1 product
  • python-scrapyAll versions (No fix recorded)

8 vendors · 28 products

References

44 links
Show all 44 references