Summary
Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression.
Security Fix(es):
* Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | brotli | 1.1.0-7.el10_1 |
| AlmaLinux · 10 | brotli-devel | 1.1.0-7.el10_1 |
| AlmaLinux · 10 | libbrotli | 1.1.0-7.el10_1 |
| AlmaLinux · 10 | python3-brotli | 1.1.0-7.el10_1 |
Vulnerabilities 1
-
High 7.5
Brotli decompression bomb DoS in scrapy/scrapy
Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to cra…