Executive brief
Scrapy is a popular web scraping framework used by developers to extract data from websites. A flaw in its brotli decompression mechanism allows malicious remote servers to cause the scraping client to crash by consuming excessive memory, effectively disabling the scraper. This could disrupt data collection workflows and impact any automated web harvesting operations.
Technical details
The vulnerability is a decompression bomb (CWE-400) in Scrapy's handling of brotli-compressed HTTP responses. Brotli compression can achieve extremely high compression ratios for zero-filled data, and Scrapy's existing decompression bomb protections do not adequately limit memory consumption for this compression format. An attacker controlling a remote server can send a brotli-compressed payload that expands to exceed 80 GB in memory during decompression, crashing the Scrapy client. The attack requires no authentication or special conditions—any network-accessible remote server responding to a Scrapy request can exploit this. Patches are available in Scrapy 2.13.4+ and require brotli v1.2.0 or later.
Affected products
- Scrapy Scrapy up to 2.13.3; fixed in 2.13.4
- Google brotli up to 1.1.0; fixed in 1.2.0
Timeline
- 2025-10-31: disclosed: Vulnerability published as GHSA-2qfp-q593-8484 and CVE-2025-6176
- 2025-10-31: patched: Scrapy 2.13.4 and brotli 1.2.0 released with fixes