# CVE-2017-14158: Scrapy uncontrolled resource consumption in S3FilesStore

Source: https://junglewise.ai/threats/cve-2017-14158-scrapy-uncontrolled-resource-consumption-in-s3filesstore  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-17. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2017-14158 · Severity: high · CVSS 7.5 · Published 2022-05-17

Scrapy, a popular web crawling and data extraction framework, is vulnerable to a denial of service attack. An attacker can provide large files that exhaust the system's memory, potentially causing the application to crash or become unresponsive. This is particularly impactful when the framework is configured to save data to slow storage services like Amazon S3.

Technologies: [scrapy (PyPI)](https://junglewise.ai/threats/technologies/scrapy). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2017-14158 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-14158 being exploited in the wild.

**How severe is CVE-2017-14158?** High severity, with a CVSS score of 7.5, published 17 May 2022.

**Which products and versions are affected?** scrapy (PyPI) >= 0.7, <= 2.15.0, ECOSYSTEM:introduced=0.7, ECOSYSTEM:introduced=0.7,last_affected=2.15.2.

**Is there a fix for CVE-2017-14158?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2017-14158 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-14158?** Check whether you run scrapy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Scrapy (versions 0.7 through 2.15.0) contains an uncontrolled resource consumption vulnerability (CWE-400). The issue stems from the interaction between the `dataReceived` handler in `core/downloader/handlers/http11.py` and the `S3FilesStore` component. When crawling, Scrapy may read an arbitrary number of large files into memory simultaneously. If these files are being written to a slow storage backend in a separate thread, the memory consumption can grow until the process crashes. This can be triggered by a remote attacker serving large files to the crawler. No patch is currently specified in the advisory for the affected version range.

## Affected products

- Scrapy Scrapy >= 0.7, <= 2.15.0

## Identifiers

- CVE-2017-14158
- GHSA-h7wm-ph43-c39p
- PYSEC-2017-83

## Timeline

- 2017-09-05: advisory: NVD published CVE-2017-14158
- 2022-05-17: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/jhutchings1](https://api.github.com/users/jhutchings1)
- [https://github.com/jhutchings1](https://github.com/jhutchings1)
- [https://api.github.com/users/jhutchings1/gists%7B/gist_id%7D](https://api.github.com/users/jhutchings1/gists%7B/gist_id%7D)
- [https://api.github.com/users/jhutchings1/repos](https://api.github.com/users/jhutchings1/repos)
- [https://avatars.githubusercontent.com/u/12853539?v=4](https://avatars.githubusercontent.com/u/12853539?v=4)
- [https://api.github.com/users/jhutchings1/events%7B/privacy%7D](https://api.github.com/users/jhutchings1/events%7B/privacy%7D)

## Related threats

- [Scrapy arbitrary code execution via Referrer-Policy header](https://junglewise.ai/threats/cve-2026-105782-scrapy-arbitrary-module-import-via-referrer-policy-header-in)
- [Scrapy S3DownloadHandler cleartext transmission of AWS credentials](https://junglewise.ai/threats/cve-2026-84366-scrapy-s3downloadhandler-cleartext-transmission-of-aws)
- [PYSEC-2026-2401 - Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation](https://junglewise.ai/threats/cve-2025-6176-scrapy-denial-of-service-via-brotli-decompression-bomb)
- [PYSEC-2026-1907 - Scrapy decompression bomb vulnerability](https://junglewise.ai/threats/cve-2024-3572-scrapy-decompression-bomb-vulnerability)
- [PYSEC-2026-1908 - Scrapy authorization header leakage on cross-domain redirect](https://junglewise.ai/threats/cve-2024-3574-scrapy-authorization-header-leakage-on-cross-domain-redirect)