PyPI/scrapy CVE-2025-6176: high 7.5, EPSS 0.55%

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Action: Upgrade scrapy to 2.13.4 or later.

pip install scrapy==2.13.4

Affected

Fixed versions

Sources

• osv: GHSA-2qfp-q593-8484#PyPI/scrapy
• https://nvd.nist.gov/vuln/detail/CVE-2025-6176
• https://github.com/google/brotli/issues/1327
• https://github.com/google/brotli/issues/1375
• https://github.com/google/brotli/pull/1234
• https://github.com/scrapy/scrapy/pull/7134
• https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627
• https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da
• https://github.com/google/brotli
• https://github.com/google/brotli/releases/tag/v1.2.0
• https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0

CVE-2025-6176 · published 2025-10-31T00:30:35Z · modified 2026-09-10T03:50:29.153413546Z · JSON