CVE-2025-6176 Scrapy Brotli Decompression Bomb DoS Vulnerability

Key Information Vulnerability Summary Vulnerability Name: Brotli decompression bomb DoS in scrapy/scrapy CVE ID: CVE-2025-6176 Submission Date: Jun 15th 2025 Status: Valid Vulnerability Type: CWE-400: Denial of Service Severity: High (7.5) Affected Versions: <=2.13.2 Discoverer: Cycloctane Description Scrapy’s encoding implementation is vulnerable to Brotli decompression bombs. Its protective measures are ineffective against Brotli variants, allowing malicious servers to perform DoS attacks on clients. Details Scrapy protects itself from Brotli decompression bombs by reading raw data in 64KB chunks and checking output size after each decompression. However, Brotli achieves extremely high compression ratios on zero-filled data; a single 64KB chunk can decompress to over 80GB, triggering Out-of-Memory (OOM) conditions on most systems. Proof of Concept 1. Generate a compressed bomb: 2. Serve it on a server: 3. Trigger Scrapy to access the site: Impact Remote servers can cause Scrapy clients with less than 80GB of available memory to crash. Locations _compression.py L32-L38 _compression.py L45 _compression.py L88-L104 Additional Information A GitHub issue requesting maintainers to create a SECURITY.md file. A discussion about extending the disclosure timeline.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-6176 Scrapy Brotli Decompression Bomb DoS Vulnerability