{"action":"Upgrade scrapy to 2.13.4 or later.","affected":[{"fixed":"2.13.4","introduced":"0"}],"component":"scrapy","cve_ids":["CVE-2025-6176"],"ecosystem":"PyPI","epss":0.00545,"exploited":false,"fixed_versions":["2.13.4"],"ghsa_id":"GHSA-2qfp-q593-8484","id":"tcs_01M5KET2JR63FK0Z4MFRHTBMYG","modified_at":"2026-09-10T03:50:29.153413546Z","published_at":"2025-10-31T00:30:35Z","references":["https://osv.dev/vulnerability/GHSA-2qfp-q593-8484","https://nvd.nist.gov/vuln/detail/CVE-2025-6176","https://github.com/google/brotli/issues/1327","https://github.com/google/brotli/issues/1375","https://github.com/google/brotli/pull/1234","https://github.com/scrapy/scrapy/pull/7134","https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627","https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da","https://github.com/google/brotli","https://github.com/google/brotli/releases/tag/v1.2.0","https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-2qfp-q593-8484#PyPI/scrapy","url":"https://osv.dev/vulnerability/GHSA-2qfp-q593-8484"}],"summary":"Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation"}