{"action":"Upgrade scrapy to 2.13.4 or later.","affected":[{"fixed":"2.13.4","introduced":"0"}],"component":"scrapy","cve_ids":["CVE-2025-6176"],"ecosystem":"PyPI","epss":0.00545,"exploited":false,"fixed_versions":["2.13.4"],"ghsa_id":"GHSA-2qfp-q593-8484","id":"tcs_01M5KGWCNN01QV47JW77NW9PDR","modified_at":"2026-07-13T16:43:00.989110436Z","published_at":"2026-07-07T16:03:09.250252Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1906","https://nvd.nist.gov/vuln/detail/CVE-2025-6176","https://github.com/google/brotli/issues/1327","https://github.com/google/brotli/issues/1375","https://github.com/google/brotli/pull/1234","https://github.com/scrapy/scrapy/pull/7134","https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627","https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da","https://github.com/google/brotli","https://github.com/google/brotli/releases/tag/v1.2.0","https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0","https://pypi.org/project/scrapy","https://github.com/advisories/GHSA-2qfp-q593-8484"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-1906","url":"https://osv.dev/vulnerability/PYSEC-2026-1906"}],"summary":"Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation"}