PyPI/brotli CVE-2025-6176: high 7.5, EPSS 0.55%
Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
Action: Upgrade brotli to 1.2.0 or later.
pip install brotli==1.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.2.0 | - |
Fixed versions
| 1.2.0 |
Sources
- osv: PYSEC-2026-2401
- https://nvd.nist.gov/vuln/detail/CVE-2025-6176
- https://github.com/google/brotli/issues/1327
- https://github.com/google/brotli/issues/1375
- https://github.com/google/brotli/pull/1234
- https://github.com/scrapy/scrapy/pull/7134
- https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627
- https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da
- https://github.com/google/brotli
- https://github.com/google/brotli/releases/tag/v1.2.0
- https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0
- https://pypi.org/project/brotli
- https://github.com/advisories/GHSA-2qfp-q593-8484
CVE-2025-6176 · published · modified · JSON