{"action":"Upgrade brotli to 1.2.0 or later.","affected":[{"fixed":"1.2.0","introduced":"0"}],"component":"brotli","cve_ids":["CVE-2025-6176"],"ecosystem":"PyPI","epss":0.00545,"exploited":false,"fixed_versions":["1.2.0"],"ghsa_id":"GHSA-2qfp-q593-8484","id":"tcs_01M5KGZ8J7ZEJR7HENARYJQM79","modified_at":"2026-07-13T16:43:00.989110436Z","published_at":"2026-07-13T14:36:34.173732Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2401","https://nvd.nist.gov/vuln/detail/CVE-2025-6176","https://github.com/google/brotli/issues/1327","https://github.com/google/brotli/issues/1375","https://github.com/google/brotli/pull/1234","https://github.com/scrapy/scrapy/pull/7134","https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627","https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da","https://github.com/google/brotli","https://github.com/google/brotli/releases/tag/v1.2.0","https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0","https://pypi.org/project/brotli","https://github.com/advisories/GHSA-2qfp-q593-8484"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2401","url":"https://osv.dev/vulnerability/PYSEC-2026-2401"}],"summary":"Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation"}