Vulnerabilities in pkg:pypi/brotli

PACKAGE
Advisory Identifier: GHSA-2qfp-q593-8484
Share
Advisory Summary

CVE-2025-6176 is a HIGH (CVSS 7.5) denial of service vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Brotli libraries in the PyPI ecosystem. The issue involves scrapy is vulnerable to a denial of service (dos) attack due to flaws in brotli decompression implementation. Remediation is available by upgrading affected packages to version 1.2.0, 2.13.4.

2 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:pypi/brotli

2 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:pypi/brotli. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-2qfp-q593-8484 CVE-2025-6176 HIGH Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
GHSA-5v8v-66v8-mwm7 CVE-2020-8927 MODERATE Integer overflow in the bundled Brotli C library

CVE-2025-6176 at a Glance

CVE Identifier CVE-2025-6176
GHSA Identifier GHSA-2qfp-q593-8484
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification CWE-400: Uncontrolled Resource Consumption
Affected Product Brotli
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2025-6176

To remediate this vulnerability, upgrade all affected Brotli dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

brotli fixed: 1.2.0 
pip install brotli>=1.2.0
Scrapy fixed: 2.13.4 
pip install Scrapy>=2.13.4
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show brotli

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2025-6176, inspect your installed packages using pip:

pip show brotli

Analyze the terminal output to locate any version of Brotli in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.2.0), your application is affected.

Note: The pip show brotli command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Brotli, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. Mitigation for this vulnerability needs security enhancement added in brotli v1.2.0.

CVE-2025-6176 Affected Brotli Versions

2 component(s)
Fixed Versions:
1.2.02.13.4
Product / Package Ecosystem Affected Versions Fixed Version
brotli
pypi/brotli
PyPI
< 1.2.0
1.2.0
Scrapy
pypi/Scrapy
PyPI
< 2.13.4
2.13.4

References

NVD — CVE-2025-6176 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6176
Brotli Source Repository REPOSITORY
https://github.com/google/brotli/issues/1327
Brotli Source Repository REPOSITORY
https://github.com/google/brotli/issues/1375
Brotli Source Repository REPOSITORY
https://github.com/google/brotli/pull/1234
Brotli Source Repository REPOSITORY
https://github.com/scrapy/scrapy/pull/7134
Security Fix Commit FIX COMMIT
https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627
Security Fix Commit FIX COMMIT
https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da
Brotli Source Repository REPOSITORY
https://github.com/google/brotli
Brotli Release RELEASE
https://github.com/google/brotli/releases/tag/v1.2.0
huntr.com/bounties/2c26a886-5... WEB
https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0

Frequently Asked Questions

What is CVE-2025-6176?
CVE-2025-6176 is a security vulnerability in Brotli involving Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation under CWE-400: Uncontrolled Resource Consumption.
Which Brotli versions are affected?
Affected versions include releases prior to 1.2.0, 2.13.4 across affected packages: brotli, Scrapy.
What version fixes CVE-2025-6176?
Upgrading to 1.2.0, 2.13.4 (or the latest patched release for your respective branch) resolves the vulnerability.
Is brotli affected?
Yes, brotli is affected in releases prior to 1.2.0. Upgrade your dependency to 1.2.0 or later.
Is Scrapy affected?
Yes, Scrapy is affected in releases prior to 2.13.4. Upgrade your dependency to 2.13.4 or later.
What is the CVSS score of CVE-2025-6176?
CVE-2025-6176 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2025-6176?
CVE-2025-6176 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).
How can I check PyPI dependencies for CVE-2025-6176?
Run the dependency tree command: 'pip show brotli'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2qfp-q593-8484",
  "modified" : "2025-11-17T15:50:19Z",
  "published" : "2025-10-31T00:30:35Z",
  "aliases" : [ "CVE-2025-6176" ],
  "summary" : "Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation",
  "details" : "Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. Mitigation for this vulnerability needs security enhancement added in brotli v1.2.0.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "brotli"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.2.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.1.0"
    }
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "Scrapy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.13.4"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.13.3"
    }
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-6176"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/google/brotli/issues/1327"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/google/brotli/issues/1375"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/google/brotli/pull/1234"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/scrapy/scrapy/pull/7134"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/google/brotli"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/google/brotli/releases/tag/v1.2.0"
  }, {
    "type" : "WEB",
    "url" : "https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-31T21:23:47Z",
    "nvd_published_at" : "2025-10-31T00:15:37Z"
  }
}