CVE-2025-6176: PYSEC-2026-2401 - Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

CVE-2025-6176 · Severity: low · CVSS 3 · Published 2026-07-13

Scrapy is a popular web scraping framework used by developers to extract data from websites. A flaw in its brotli decompression mechanism allows malicious remote servers to cause the scraping client to crash by consuming excessive memory, effectively disabling the scraper. This could disrupt data collection workflows and impact any automated web harvesting operations.

Technologies: Google Brotli, brotli (PyPI), scrapy (PyPI). Vendors: Google, PyPI.

Quick answers

Is CVE-2025-6176 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-6176 being exploited in the wild.
How severe is CVE-2025-6176?
Low severity, with a CVSS score of 3, published 13 July 2026.
Which products and versions are affected?
Google Brotli up to 1.1.0; fixed in 1.2.0; brotli (PyPI) ECOSYSTEM:introduced=0,fixed=1.2.0; scrapy (PyPI) ECOSYSTEM:introduced=0,fixed=2.13.4.
Is there a fix for CVE-2025-6176?
Yes. brotli (PyPI): upgrade to 1.2.0 or later; scrapy (PyPI): upgrade to 2.13.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-6176 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-6176?
Check whether you run Google Brotli, brotli (PyPI) or scrapy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • brotli (PyPI): upgrade to 1.2.0 or later
    pip install "brotli>=1.2.0"
  • scrapy (PyPI): upgrade to 2.13.4 or later
    pip install "scrapy>=2.13.4"

Technical details

The vulnerability is a decompression bomb (CWE-400) in Scrapy's handling of brotli-compressed HTTP responses. Brotli compression can achieve extremely high compression ratios for zero-filled data, and Scrapy's existing decompression bomb protections do not adequately limit memory consumption for this compression format. An attacker controlling a remote server can send a brotli-compressed payload that expands to exceed 80 GB in memory during decompression, crashing the Scrapy client. The attack requires no authentication or special conditions—any network-accessible remote server responding to a Scrapy request can exploit this. Patches are available in Scrapy 2.13.4+ and require brotli v1.2.0 or later.

Affected products

  • Scrapy Scrapy up to 2.13.3; fixed in 2.13.4
  • Google brotli up to 1.1.0; fixed in 1.2.0

Identifiers

  • CVE-2025-6176
  • GHSA-2qfp-q593-8484
  • PYSEC-2026-1906
  • PYSEC-2026-2401

Timeline

  • 2025-10-31: disclosed: Vulnerability published as GHSA-2qfp-q593-8484 and CVE-2025-6176
  • 2025-10-31: patched: Scrapy 2.13.4 and brotli 1.2.0 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.