{"action":"Upgrade brotli to 1.2.0 or later.","affected":[{"fixed":"1.2.0","introduced":"0"}],"component":"brotli","cve_ids":["CVE-2025-6176"],"ecosystem":"PyPI","epss":0.00545,"exploited":false,"fixed_versions":["1.2.0"],"ghsa_id":"GHSA-2qfp-q593-8484","id":"tcs_01M5KET2CVQN99WBSFFC5ZNMFH","modified_at":"2026-09-10T03:50:29.153413546Z","published_at":"2025-10-31T00:30:35Z","references":["https://osv.dev/vulnerability/GHSA-2qfp-q593-8484","https://nvd.nist.gov/vuln/detail/CVE-2025-6176","https://github.com/google/brotli/issues/1327","https://github.com/google/brotli/issues/1375","https://github.com/google/brotli/pull/1234","https://github.com/scrapy/scrapy/pull/7134","https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627","https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da","https://github.com/google/brotli","https://github.com/google/brotli/releases/tag/v1.2.0","https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-2qfp-q593-8484","url":"https://osv.dev/vulnerability/GHSA-2qfp-q593-8484"}],"summary":"Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation"}