brotli: Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompres...
CVE-2025-6176 is fixed in 6 products on 1 platform, first by RHSA-2026:0008, released October 31, 2025. It is not reported as exploited. Patch Radar priority: High.
Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| brotli · RHEL 10 | 1.1.0-6.el10_0.1 | RHSA-2026:0008 | Oct 31, 2025 |
| brotli · RHEL 8 | 0:1.0.6-4.el8_10 | RHSA-2026:2389 | Feb 10, 2026 |
| brotli · RHEL 9 | 0:1.0.9-9.el9_7 | RHSA-2026:2042 | Feb 5, 2026 |
| brotli · almalinux 10 | 1.1.0-7.el10_1 | ALSA-2026:0845 | Jan 20, 2026 |
| brotli · almalinux 8 | 1.0.6-4.el8_10 | ALSA-2026:2389 | Feb 10, 2026 |
| brotli · almalinux 9 | 1.0.9-9.el9_7 | ALSA-2026:2042 | Feb 5, 2026 |
| brotli · ol 10 | 0:1.1.0-7.el10_1 | ELSA-2026-0845 | Jan 20, 2026 |
| brotli · ol 8 | 0:1.0.6-4.el8_10 | ELSA-2026-2389 | Feb 10, 2026 |
| brotli · ol 9 | 0:1.0.9-9.el9_7 | ELSA-2026-2042 | Feb 5, 2026 |
| brotli · rocky 10 | 0:1.1.0-7.el10_1 | RLSA-2026:0845 | Jan 21, 2026 |
| brotli · rocky 8 | 0:1.0.6-4.el8_10 | RLSA-2026:2389 | Feb 11, 2026 |
| brotli · rocky 9 | 0:1.0.9-9.el9_7 | RLSA-2026:2042 | Feb 7, 2026 |
| brotli-devel · RHEL 8 | 0:1.0.6-4.el8_10 | RHSA-2026:2389 | Feb 10, 2026 |
| brotli-devel · RHEL 9 | 0:1.0.9-9.el9_7 | RHSA-2026:2042 | Feb 5, 2026 |
| brotli-devel · almalinux 10 | 1.1.0-7.el10_1 | ALSA-2026:0845 | Jan 20, 2026 |
| brotli-devel · almalinux 8 | 1.0.6-4.el8_10 | ALSA-2026:2389 | Feb 10, 2026 |
| brotli-devel · almalinux 9 | 1.0.9-9.el9_7 | ALSA-2026:2042 | Feb 5, 2026 |
| brotli-devel · ol 10 | 0:1.1.0-7.el10_1 | ELSA-2026-0845 | Jan 20, 2026 |
| brotli-devel · ol 8 | 0:1.0.6-4.el8_10 | ELSA-2026-2389 | Feb 10, 2026 |
| brotli-devel · ol 9 | 0:1.0.9-9.el9_7 | ELSA-2026-2042 | Feb 5, 2026 |
| libbrotli · RHEL 9 | 0:1.0.9-9.el9_7 | RHSA-2026:2042 | Feb 5, 2026 |
| libbrotli · almalinux 10 | 1.1.0-7.el10_1 | ALSA-2026:0845 | Jan 20, 2026 |
| libbrotli · almalinux 9 | 1.0.9-9.el9_7 | ALSA-2026:2042 | Feb 5, 2026 |
| libbrotli · ol 10 | 0:1.1.0-7.el10_1 | ELSA-2026-0845 | Jan 20, 2026 |
| libbrotli · ol 9 | 0:1.0.9-9.el9_7 | ELSA-2026-2042 | Feb 5, 2026 |
| python-Brotli · opensuse-leap 16.0 | 1.2.1-160000.1.1 | OPENSUSE-SU-2026:22183-1 | Nov 7, 2026 |
| python-scrapy · Debian 14 | 2.13.4-1 | DEBIAN-CVE-2025-6176 | Oct 31, 2025 |
| python3-brotli · RHEL 8 | 0:1.0.6-4.el8_10 | RHSA-2026:2389 | Feb 10, 2026 |
| python3-brotli · RHEL 9 | 0:1.0.9-9.el9_7 | RHSA-2026:2042 | Feb 5, 2026 |
| python3-brotli · almalinux 10 | 1.1.0-7.el10_1 | ALSA-2026:0845 | Jan 20, 2026 |
| python3-brotli · almalinux 8 | 1.0.6-4.el8_10 | ALSA-2026:2389 | Feb 10, 2026 |
| python3-brotli · almalinux 9 | 1.0.9-9.el9_7 | ALSA-2026:2042 | Feb 5, 2026 |
| python3-brotli · ol 10 | 0:1.1.0-7.el10_1 | ELSA-2026-0845 | Jan 20, 2026 |
| python3-brotli · ol 8 | 0:1.0.6-4.el8_10 | ELSA-2026-2389 | Feb 10, 2026 |
| python3-brotli · ol 9 | 0:1.0.9-9.el9_7 | ELSA-2026-2042 | Feb 5, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.