Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0008 advisory.

    Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a     modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression     ratio comparable to the best currently available general-purpose compression methods. It is similar in     speed with deflate but offers more dense compression.

    Security Fix(es):

    * Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0957 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-6176:
    Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its     brotli decompression implementation. The protection mechanism against decompression bombs fails to     mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available     memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data,     leading to excessive memory consumption during decompression.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-9e233a4e22 advisory.

    Update `brotli` to [1.2.0](https://github.com/google/brotli/blob/v1.2.0/CHANGELOG.md).

    This update provides the necessary Python APIs in `python3-brotli` to fix denial-of-service security     issues related to decompression bombs, such as CVE-2025-66471 or CVE-2025-6176, but actually fixing     them would require separate updates in affected packages.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-d93200cf16 advisory.

    Update `brotli` to [1.2.0](https://github.com/google/brotli/blob/v1.2.0/CHANGELOG.md) and `python-urllib3`     to [2.6.1](https://github.com/urllib3/urllib3/blob/2.6.1/CHANGES.rst).

    In python-urllib3:

    - Fixed a security issue where streaming API could improperly handle highly       compressed HTTP content (decompression bombs) leading to excessive resource       consumption even when a small amount of data was requested. Reading small       chunks of compressed data is safer and much more efficient now.
      (CVE-2025-66471 / [`GHSA-2xpw-w6gg-     jr37](https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37))
    - Fixed a security issue where an attacker could compose an HTTP response with       virtually unlimited links in the `Content-Encoding` header, potentially       leading to a denial of service (DoS) attack by exhausting system resources       during decoding. The number of allowed chained encodings is now limited to 5.
      (CVE-2025-66418 / [`GHSA-gm62-xv2j-4w53](https://github.com/urllib3/urllib3/security/advisories/GHSA-     gm62-xv2j-4w53))

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991041 advisory.

    Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its     brotli decompression implementation. The protection mechanism against decompression bombs fails to     mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available     memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data,     leading to excessive memory consumption during decompression.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The detected version of the Brotli Python package, Brotli, is prior or equal to 1.1.0. It is, therefore, affected by a denial of service (DoS) vulnerability due to decompression.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its     brotli decompression implementation. The protection mechanism against decompression bombs fails to     mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available     memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data,     leading to excessive memory consumption during decompression. (CVE-2025-6176)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
281647	RHEL 10 : brotli (RHSA-2026:0008)	Nessus	Red Hat Local Security Checks	high
279072	TencentOS Server 4: brotli (TSSA-2025:0957)	Nessus	Tencent Local Security Checks	high
279043	Fedora 42 : brotli / perl-Alien-Brotli (2025-9e233a4e22)	Nessus	Fedora Local Security Checks	high
278404	Fedora 43 : brotli / perl-Alien-Brotli / python-urllib3 (2025-d93200cf16)	Nessus	Fedora Local Security Checks	high
277864	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: brotli (UTSA-2025-991041)	Nessus	Unity Linux Local Security Checks	high
274433	Python Library Brotli <= 1.1.0 DoS	Nessus	Misc.	high
272129	Linux Distros Unpatched Vulnerability : CVE-2025-6176	Nessus	Misc.	high

Detections

Analytics

CVE-2025-6176

high

Tenable Plugins

high

high

high

high

high

high

high